Linux Kernel Input Device Vulnerability in ALSA's Caiaq Driver

CVE-2026-98837

What is CVE-2026-98837?

A vulnerability in the ALSA Caiaq driver of the Linux kernel allows an input device to remain registered even after probe failures occur. When the setup_card() function triggers a failure during snd_card_register() or snd_usb_caiaq_control_init(), the probe erroneously does not unregister the input device, potentially leading to a use-after-free situation. This occurs when the device's uevent attribute is accessed after its memory has been freed, which may allow attackers to exploit the freed memory, resulting in undefined behavior or system crashes.

References