CVE-2026-98837
- Source
- https://cve.org/CVERecord?id=CVE-2026-98837
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98837.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-98837
- Downstream
- Published
- 2026-10-18T15:50:05Z
- Modified
- 2026-10-19T02:47:32Z
- Summary
- ALSA: caiaq: unregister the input device when probe fails
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
ALSA: caiaq: unregister the input device when probe fails
setup_card() registers the input device, whose name and phys point into struct snd_usb_caiaqdev, and then goes on to snd_card_register() and snd_usb_caiaq_control_init(). If either fails, snd_probe() calls snd_card_free(), which frees the device state but leaves the input device registered: card_free() only clears the pointer, and the input device is unregistered from snd_disconnect() alone. Reading its "uevent" attribute afterwards dereferences freed memory:
BUG: KASAN: slab-use-after-free in string+0x4a9/0x4f0 Read of size 1 at addr ffff8880208f5043 by task caiaq/4967 add_uevent_var+0x183/0x3a0 input_dev_uevent+0x162/0x900 dev_uevent+0x2f1/0x870 uevent_show+0x1ca/0x3a0 ...
Unregister the input device on the probe error path, as snd_disconnect() does. snd_usb_caiaq_input_disconnect() is a no-op when no input device was registered.
Reproduced with a raw-gadget Audio Kontrol 1 and a temporary hack that makes snd_usb_caiaq_control_init() fail.
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98837.json" }- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/0b7bd20f6379bc5e431fd74d866390f5b5b63f3c
- https://git.kernel.org/stable/c/2e5a413cc2a489c9427ecd3d73ad764bfb0c7103
- https://git.kernel.org/stable/c/84727facd8506140cd04f2b0a8b1c4ddeac41cea
- https://git.kernel.org/stable/c/850810c12686f80cdf7530f4f21e0157d904f739
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98837.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-98837
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6251e3e256337a30160ef59ab1580dde4d1acd28Fixed850810c12686f80cdf7530f4f21e0157d904f739
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducede59ecd4ee3a450db6cb4e4ecaa3efdd593f80056Fixed84727facd8506140cd04f2b0a8b1c4ddeac41cea
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced28abd224db4a49560b452115bca3672a20e45b2fFixed2e5a413cc2a489c9427ecd3d73ad764bfb0c7103Fixed0b7bd20f6379bc5e431fd74d866390f5b5b63f3c
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6.12.86Fixed6.12.113
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6.18.27Fixed6.18.56
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced5.10.258Fixed5.11
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced5.15.209Fixed5.16
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6.1.175Fixed6.2
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6.6.140Fixed6.7
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced7.0.4Fixed7.1
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedda938aa9fc7826901921dcea225948ab21a97e45
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced09616e25f502080ba684fc7fcf959d1376ab756d
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedb956e48371f2ff72b76be9a829800ecec963bd45
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedf537e3ad69609f6924a4db6b4a7f6561f5288bdd
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced096dd8519cf2f768e9e14f224b627f7aaee1a9c5
Affected versions
v5.*
v5.10.258
v5.10.259
v5.10.260
v5.10.261
v5.10.262
v5.10.263
v5.10.264
v5.10.265
v5.10.266
v5.10.267
v5.10.268
v5.10.269
v5.10.270
v5.10.271
v5.10.272
v5.15.209
v5.15.210
v5.15.211
v5.15.212
v5.15.213
v5.15.214
v5.15.215
v5.15.216
v5.15.217
v5.15.218
v5.15.219
v5.15.220
v5.15.221
v5.15.222
v5.15.223
v6.*
v6.1.175
v6.1.176
v6.1.177
v6.1.178
v6.1.179
v6.1.180
v6.1.181
v6.1.182
v6.1.183
v6.1.184
v6.1.185
v6.1.186
v6.1.187
v6.1.188
v6.1.189
v6.1.190
v6.12.100
v6.12.101
v6.12.102
v6.12.103
v6.12.104
v6.12.105
v6.12.106
v6.12.107
v6.12.108
v6.12.109
v6.12.110
v6.12.111
v6.12.112
v6.12.86
v6.12.87
v6.12.88
v6.12.89
v6.12.90
v6.12.91
v6.12.92
v6.12.93
v6.12.94
v6.12.95
v6.12.96
v6.12.97
v6.12.98
v6.12.99
v6.18.27
v6.18.28
v6.18.29
v6.18.30
v6.18.31
v6.18.32
v6.18.33
v6.18.34
v6.18.35
v6.18.36
v6.18.37
v6.18.38
v6.18.39
v6.18.40
v6.18.41
v6.18.42
v6.18.43
v6.18.44
v6.18.45
v6.18.46
v6.18.47
v6.18.48
v6.18.49
v6.18.50
v6.18.51
v6.18.52
v6.18.53
v6.18.54
v6.18.55
v6.6.140
v6.6.141
v6.6.142
v6.6.143
v6.6.144
v6.6.145
v6.6.146
v6.6.147
v6.6.148
v6.6.149
v6.6.150
v6.6.151
v6.6.152
v6.6.153
v6.6.154
v6.6.155
v6.6.156
v6.6.157
v6.6.158
v6.6.159
v7.*
v7.0.10
v7.0.11
v7.0.12
v7.0.13
v7.0.14
v7.0.4
v7.0.5
v7.0.6
v7.0.7
v7.0.8
v7.0.9