---
id: CVE-2026-98837
title: 'ALSA: caiaq: unregister the input device when probe fails'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ALSA: caiaq: unregister the input device when probe fails

  setup_card() registers the input device, whose name and phys point into
  struct snd_usb_caiaqdev, and then goe…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 6251e3e256337a30160ef59ab1580dde4d1acd28 <
    850810c12686f80cdf7530f4f21e0157d904f739
  - >-
    Linux >= e59ecd4ee3a450db6cb4e4ecaa3efdd593f80056 <
    84727facd8506140cd04f2b0a8b1c4ddeac41cea
  - >-
    Linux >= 28abd224db4a49560b452115bca3672a20e45b2f <
    2e5a413cc2a489c9427ecd3d73ad764bfb0c7103
  - >-
    Linux >= 28abd224db4a49560b452115bca3672a20e45b2f <
    0b7bd20f6379bc5e431fd74d866390f5b5b63f3c
  - Linux da938aa9fc7826901921dcea225948ab21a97e45
  - Linux 09616e25f502080ba684fc7fcf959d1376ab756d
  - Linux b956e48371f2ff72b76be9a829800ecec963bd45
  - Linux f537e3ad69609f6924a4db6b4a7f6561f5288bdd
  - Linux 096dd8519cf2f768e9e14f224b627f7aaee1a9c5
  - Linux >= 6.12.86 < 6.12.113
  - Linux >= 6.18.27 < 6.18.56
  - Linux >= 5.10.258 < 5.11
  - Linux >= 5.15.209 < 5.16
  - Linux >= 6.1.175 < 6.2
  - Linux >= 6.6.140 < 6.7
  - Linux >= 7.0.4 < 7.1
  - Linux 7.1
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:50:05.338Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98837'
references:
  - url: 'https://git.kernel.org/stable/c/850810c12686f80cdf7530f4f21e0157d904f739'
  - url: 'https://git.kernel.org/stable/c/84727facd8506140cd04f2b0a8b1c4ddeac41cea'
  - url: 'https://git.kernel.org/stable/c/2e5a413cc2a489c9427ecd3d73ad764bfb0c7103'
  - url: 'https://git.kernel.org/stable/c/0b7bd20f6379bc5e431fd74d866390f5b5b63f3c'
tags:
  - cve.org
ingestedAt: '2026-10-18T16:47:32.469Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ALSA: caiaq: unregister the input device when probe fails

setup_card() registers the input device, whose name and phys point into
struct snd_usb_caiaqdev, and then goes on to snd_card_register() and
snd_usb_caiaq_control_init(). If either fails, snd_probe() calls
snd_card_free(), which frees the device state but leaves the input
device registered: card_free() only clears the pointer, and the input
device is unregistered from snd_disconnect() alone. Reading its "uevent"
attribute afterwards dereferences freed memory:

  BUG: KASAN: slab-use-after-free in string+0x4a9/0x4f0
  Read of size 1 at addr ffff8880208f5043 by task caiaq/4967
   add_uevent_var+0x183/0x3a0
   input_dev_uevent+0x162/0x900
   dev_uevent+0x2f1/0x870
   uevent_show+0x1ca/0x3a0
   ...

Unregister the input device on the probe error path, as
snd_disconnect() does. snd_usb_caiaq_input_disconnect() is a no-op when
no input device was registered.

Reproduced with a raw-gadget Audio Kontrol 1 and a temporary hack that
makes snd_usb_caiaq_control_init() fail.

## Affected

- `Linux >= 6251e3e256337a30160ef59ab1580dde4d1acd28 < 850810c12686f80cdf7530f4f21e0157d904f739`
- `Linux >= e59ecd4ee3a450db6cb4e4ecaa3efdd593f80056 < 84727facd8506140cd04f2b0a8b1c4ddeac41cea`
- `Linux >= 28abd224db4a49560b452115bca3672a20e45b2f < 2e5a413cc2a489c9427ecd3d73ad764bfb0c7103`
- `Linux >= 28abd224db4a49560b452115bca3672a20e45b2f < 0b7bd20f6379bc5e431fd74d866390f5b5b63f3c`
- `Linux da938aa9fc7826901921dcea225948ab21a97e45`
- `Linux 09616e25f502080ba684fc7fcf959d1376ab756d`
- `Linux b956e48371f2ff72b76be9a829800ecec963bd45`
- `Linux f537e3ad69609f6924a4db6b4a7f6561f5288bdd`
- `Linux 096dd8519cf2f768e9e14f224b627f7aaee1a9c5`
- `Linux >= 6.12.86 < 6.12.113`
- `Linux >= 6.18.27 < 6.18.56`
- `Linux >= 5.10.258 < 5.11`
- `Linux >= 5.15.209 < 5.16`
- `Linux >= 6.1.175 < 6.2`
- `Linux >= 6.6.140 < 6.7`
- `Linux >= 7.0.4 < 7.1`
- `Linux 7.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.