PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45992 Linux CVE debrief

A vulnerability in the Linux kernel's ALSA caiaq audio driver could allow a resource leak when device initialization fails. The issue occurs because an internal USB Request Block (URB) named `ep1_in_urb` may be submitted before `setup_card()` encounters an error, but was not properly cleaned up in that error path. While the URB is normally killed during device disconnection, the error path lacked this cleanup, potentially leaving the URB active. This is a local issue affecting kernel memory management rather than a remotely exploitable vulnerability. The fix ensures the URB is properly killed in the error path of `setup_card()`.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-15
Advisory published
2026-05-27
Advisory updated
2026-06-15

Who should care

Organizations running Linux systems with Native Instruments CAIAQ-based audio devices (such as certain DJ controllers and audio interfaces) should apply kernel updates when available. General Linux users without this specific hardware are minimally affected.

Technical summary

The ALSA caiaq driver in the Linux kernel failed to kill the `ep1_in_urb` USB Request Block when `setup_card()` returned an error, potentially leaving an active URB that should have been cleaned up. The fix adds proper URB cleanup to the error path.

Defensive priority

low

Recommended defensive actions

  • Apply kernel updates containing the referenced stable commits when available from your Linux distribution
  • Monitor vendor security advisories for kernel package updates addressing CVE-2026-45992
  • No immediate action required for systems not using Native Instruments CAIAQ audio devices
  • Review systems with attached Native Instruments audio interfaces for kernel update status

Evidence notes

The CVE description and kernel commit references confirm this is a fix for a URB leak in the ALSA caiaq driver error path. The vulnerability requires local access to trigger the specific error condition in device initialization. No CVSS score has been assigned as of the CVE publication date.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45992 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45992

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45992 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45992

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/0a7b5221b5b51cc798fcfc3be00d02eade149d69

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/1d160e30aa42b7c41163e51366bb34432367260d

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/438ab932dc6fef5b001dfeba08a18a491edc8f7b

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/be62c8bb03b6aec3790a943d4a7567d4d73b8be9

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/e0fb842af7052f0ab9e709db0c59300aa4051fc0

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.