{"id":"CVE-2026-98837","aliases":[],"cve":{"records":[{"id":"CVE-2026-98837","source":"Linux","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-25T10:25:14.372Z","published":"2026-10-18T15:50:05.338Z","modified":"2026-10-30T12:40:06.606Z"}],"publishers":[{"name":"Linux","role":"CNA","organizationId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","modified":"2026-10-30T12:40:06.606Z"}],"references":[{"url":"https://git.kernel.org/stable/c/7017c9dda1ebbab428a6fd29c841596b5c9c84d1","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/8315ea07ebb2497531ff42dd640396f6f1d4a8f0","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/1d5d194594ff616ad36a052bde739d1cf5855b95","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/df2787819bd137111b56b8631dd581b0cce7144d","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/850810c12686f80cdf7530f4f21e0157d904f739","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/84727facd8506140cd04f2b0a8b1c4ddeac41cea","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/2e5a413cc2a489c9427ecd3d73ad764bfb0c7103","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/0b7bd20f6379bc5e431fd74d866390f5b5b63f3c","tags":[],"source":"Linux"}],"weaknesses":[],"applicability":[{"source":"Linux","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10.258","versionEndExcluding":"5.10.273"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15.209","versionEndExcluding":"5.15.224"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1.175","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6.140","versionEndExcluding":"6.6.160"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12.86","versionEndExcluding":"6.12.113"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.18.27","versionEndExcluding":"6.18.56"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.1","versionEndExcluding":"7.2.10"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.1","versionEndExcluding":"7.3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0.4"}]}]}]}],"prioritization":[]},"title":"ALSA: caiaq: unregister the input device when probe fails","titleSource":"Linux","descriptionSource":"Linux","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: caiaq: unregister the input device when probe fails\n\nsetup_card() registers the input device, whose name and phys point into\nstruct snd_usb_caiaqdev, and then goes on to snd_card_register() and\nsnd_usb_caiaq_control_init(). If either fails, snd_probe() calls\nsnd_card_free(), which frees the device state but leaves the input\ndevice registered: card_free() only clears the pointer, and the input\ndevice is unregistered from snd_disconnect() alone. Reading its \"uevent\"\nattribute afterwards dereferences freed memory:\n\n  BUG: KASAN: slab-use-after-free in string+0x4a9/0x4f0\n  Read of size 1 at addr ffff8880208f5043 by task caiaq/4967\n   add_uevent_var+0x183/0x3a0\n   input_dev_uevent+0x162/0x900\n   dev_uevent+0x2f1/0x870\n   uevent_show+0x1ca/0x3a0\n   ...\n\nUnregister the input device on the probe error path, as\nsnd_disconnect() does. snd_usb_caiaq_input_disconnect() is a no-op when\nno input device was registered.\n\nReproduced with a raw-gadget Audio Kontrol 1 and a temporary hack that\nmakes snd_usb_caiaq_control_init() fail.","score":null,"severity":"unknown","published":"2026-10-18T15:50:05.338Z","modified":"2026-10-30T12:40:06.606Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Linux","name":"Linux","platforms":[],"versions":[{"version":"da938aa9fc7826901921dcea225948ab21a97e45","status":"affected","lessThan":"7017c9dda1ebbab428a6fd29c841596b5c9c84d1","versionType":"git"},{"version":"09616e25f502080ba684fc7fcf959d1376ab756d","status":"affected","lessThan":"8315ea07ebb2497531ff42dd640396f6f1d4a8f0","versionType":"git"},{"version":"b956e48371f2ff72b76be9a829800ecec963bd45","status":"affected","lessThan":"1d5d194594ff616ad36a052bde739d1cf5855b95","versionType":"git"},{"version":"f537e3ad69609f6924a4db6b4a7f6561f5288bdd","status":"affected","lessThan":"df2787819bd137111b56b8631dd581b0cce7144d","versionType":"git"},{"version":"6251e3e256337a30160ef59ab1580dde4d1acd28","status":"affected","lessThan":"850810c12686f80cdf7530f4f21e0157d904f739","versionType":"git"},{"version":"e59ecd4ee3a450db6cb4e4ecaa3efdd593f80056","status":"affected","lessThan":"84727facd8506140cd04f2b0a8b1c4ddeac41cea","versionType":"git"},{"version":"28abd224db4a49560b452115bca3672a20e45b2f","status":"affected","lessThan":"2e5a413cc2a489c9427ecd3d73ad764bfb0c7103","versionType":"git"},{"version":"28abd224db4a49560b452115bca3672a20e45b2f","status":"affected","lessThan":"0b7bd20f6379bc5e431fd74d866390f5b5b63f3c","versionType":"git"},{"version":"096dd8519cf2f768e9e14f224b627f7aaee1a9c5","status":"affected","versionType":"git"},{"version":"5.10.258","status":"affected","lessThan":"5.10.273","versionType":"semver"},{"version":"5.15.209","status":"affected","lessThan":"5.15.224","versionType":"semver"},{"version":"6.1.175","status":"affected","lessThan":"6.1.191","versionType":"semver"},{"version":"6.6.140","status":"affected","lessThan":"6.6.160","versionType":"semver"},{"version":"6.12.86","status":"affected","lessThan":"6.12.113","versionType":"semver"},{"version":"6.18.27","status":"affected","lessThan":"6.18.56","versionType":"semver"},{"version":"7.0.4","status":"affected","lessThan":"7.1","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"Linux","url":"https://www.cve.org/CVERecord?id=CVE-2026-98837"},{"vendor":"Linux","name":"Linux","platforms":[],"versions":[{"version":"7.1","status":"affected"},{"version":"0","status":"unaffected","lessThan":"7.1","versionType":"semver"},{"version":"5.10.273","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.224","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.113","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.56","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.10","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"defaultStatus":"affected","cpes":[],"source":"Linux","url":"https://www.cve.org/CVERecord?id=CVE-2026-98837"}],"remediation":[],"references":["https://git.kernel.org/stable/c/7017c9dda1ebbab428a6fd29c841596b5c9c84d1","https://git.kernel.org/stable/c/8315ea07ebb2497531ff42dd640396f6f1d4a8f0","https://git.kernel.org/stable/c/1d5d194594ff616ad36a052bde739d1cf5855b95","https://git.kernel.org/stable/c/df2787819bd137111b56b8631dd581b0cce7144d","https://git.kernel.org/stable/c/850810c12686f80cdf7530f4f21e0157d904f739","https://git.kernel.org/stable/c/84727facd8506140cd04f2b0a8b1c4ddeac41cea","https://git.kernel.org/stable/c/2e5a413cc2a489c9427ecd3d73ad764bfb0c7103","https://git.kernel.org/stable/c/0b7bd20f6379bc5e431fd74d866390f5b5b63f3c"],"sources":[{"name":"CVE","id":"CVE-2026-98837","modified":"2026-10-30T12:40:06.606Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-98837"}],"assessments":[],"sourceAffected":[],"observedAt":"2026-10-30T13:09:39.358Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:30:32.029Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"The Linux kernel has a vulnerability in the ALSA caiaq module, where the input device is not unregistered when probe fails, leading to a use-after-free error. Affected versions include 5.10.258 to 5.10.273, 5.15.209 to 5.15.224, 6.1.175 to 6.1.191, 6.6.140 to 6.6.160, 6.12.86 to 6.12.113, 6.18.27 to 6.18.56, and 7.0.4 to 7.1. The vulnerability requires local access to the system.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T13:46:46.959Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-98837"}]}}