CVE-2026-31701
Use-After-Free in Linux Kernel ALSA caiaq Driver
Publication date: 2026-05-01
Last updated on: 2026-05-06
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.13 |
| linux | linux_kernel | 7.1 |
| linux | linux_kernel | 7.1 |
| linux | linux_kernel | From 6.13 (inc) to 6.18.25 (exc) |
| linux | linux_kernel | From 6.19 (inc) to 7.0.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's ALSA caiaq driver. The driver stores a pointer to the parent USB device without taking a proper reference on it. As a result, when the card's private_free callback runs asynchronously after the USB device has been disconnected and freed, it may dereference a freed USB device pointer, leading to use-after-free issues.
Additionally, the current implementation calls usb_reset_device() during the free callback, which is inappropriate because the device is being removed. This reset call can cause race conditions with the device disconnect process.
The fix involves taking a reference on the USB device when creating the card and releasing it in the free callback, as well as removing the usb_reset_device() call.
How can this vulnerability impact me? :
This vulnerability can lead to use-after-free conditions in the kernel, which may cause system instability, crashes, or potential escalation of privileges if exploited. Accessing freed memory can result in unpredictable behavior or security risks on affected systems using the ALSA caiaq driver.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is caused by the caiaq ALSA driver in the Linux kernel not properly taking a reference on the USB device, leading to use-after-free issues.
To mitigate this vulnerability, update the Linux kernel to a version where the caiaq driver has been fixed to take a reference on the USB device in create_card() using usb_get_dev(), and drop it with usb_put_dev() in the free callback.
Additionally, the fix removes the inappropriate call to usb_reset_device() in the free callback, which should also be present in the updated driver code.