PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46004 Linux CVE debrief

A use-after-free (UAF) vulnerability exists in the Linux kernel's ALSA caiaq audio driver. The `setup_card()` probe function failed to properly handle errors from `snd_card_register()`, calling `snd_card_free()` but continuing execution instead of returning an error. This leads to subsequent calls like `snd_usb_caiaq_control_init()` operating on freed memory. The fix converts `setup_card()` to return error codes and removes the erroneous `snd_card_free()` call, allowing proper error propagation to `snd_probe()` which handles cleanup correctly.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

Organizations running Linux systems with caiaq USB audio devices; kernel maintainers and distribution security teams responsible for stable kernel updates

Technical summary

The ALSA caiaq driver's `setup_card()` function, responsible for initializing USB audio devices, contained a critical error handling flaw. When `snd_card_register()` failed, the function would call `snd_card_free()` to release resources but continue execution rather than aborting. This caused subsequent initialization routines—specifically `snd_usb_caiaq_control_init()`—to access memory that had already been freed, resulting in a use-after-free condition. The vulnerability stems from `setup_card()` being defined as `void`, preventing error propagation to its caller `snd_probe()`. The resolution modifies `setup_card()` to return `int` error codes, removes the premature `snd_card_free()` call, and allows `snd_probe()` to handle cleanup through its existing error path. The fix maintains safety for `card->private_free` callbacks, as all invoked functions include NULL and unassigned resource checks.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel patches from stable branches once available for your distribution
  • Monitor distribution security advisories for kernel updates addressing CVE-2026-46004
  • If using affected caiaq USB audio devices, consider temporary disablement until patched
  • Review system logs for ALSA caiaq driver probe failures that may indicate exploitation attempts

Evidence notes

The vulnerability description indicates this was resolved via kernel patches that change `setup_card()` from a void function to one returning error codes, enabling proper error propagation rather than continuing execution after failed registration. Multiple stable kernel branch commits are referenced.

Official resources

2026-05-27