GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-46048 (GCVE-0-2026-46048)

Vulnerability from cvelistv5 – Published: 2026-05-27 12:57 – Updated: 2026-06-14 17:50
VLAI
Title
ALSA: caiaq: fix usb_dev refcount leak on probe failure
Summary
In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: fix usb_dev refcount leak on probe failure create_card() takes a reference on the USB device with usb_get_dev() and stores the matching usb_put_dev() in card_free(), which is installed as the snd_card's ->private_free destructor. However, ->private_free is only assigned near the end of init_card(), after several failure points (usb_set_interface(), EP type checks, usb_submit_urb(), the EP1_CMD_GET_DEVICE_INFO exchange, and its timeout). When any of those fail, init_card() returns an error to snd_probe(), which calls snd_card_free(card). Because ->private_free is still NULL, card_free() never runs, the usb_get_dev() reference is not dropped, and the struct usb_device leaks along with its descriptor allocations and device_private. syzbot reproduces this with a malformed UAC3 device whose only valid altsetting is 0; init_card()'s usb_set_interface(usb_dev, 0, 1) call fails with -EIO and triggers the leak. Move the ->private_free assignment into create_card(), immediately after usb_get_dev(), so that every error path reaching snd_card_free() balances the reference. card_free()'s callees (snd_usb_caiaq_input_free, free_urbs, kfree) already tolerate the partially-initialized state because the chip private area is zero-initialized by snd_card_new().
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 493b3a682ededc804555755f5d2193201339612d , < c874db8a1d2f9f08161470d00cfe8db2f5cca2cc (git)
Affected: dbcf7588e8dea017ddb3f18ec2766f7d2e5f2a0e , < 6fa8dff64fb6c401ced40a05797b327659317498 (git)
Affected: ac7345f68cda6989016d85d63f7b244c064aa8f6 , < a8d907acc3e5a078c2e5637ff60c30c6d2ddc23a (git)
Affected: f6634af5de728a46792f674a66d7843570cb68f7 , < 50c6a1f05973f56d23280c9d7645a7a5734e0907 (git)
Affected: 1d9be95aee6c6246a21752e60c9519902649f482 , < da3b8fd6a202d94fef11a443abc9171c52426a1c (git)
Affected: 6473ed16df1fe88051140611b3eb9a49be7f429e , < 6153878c5255bb69b7d0868105ca078ef13cbcf8 (git)
Affected: 59b622a043cffc58b7638cd85ae6c30a0904f8e6 , < 21ca595aafa40d3ac70eab1f4cb62cc00ca21657 (git)
Affected: 80bb50e2d459213cccff3111d5ef98ed4238c0d5 , < 7a5f1cd22d47f8ca4b760b6334378ae42c1bd24b (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.6.136 , < 6.6.140 (semver)
Affected: 6.12.84 , < 6.12.86 (semver)
Affected: 6.18.25 , < 6.18.27 (semver)
Affected: 7.0.2 , < 7.0.4 (semver)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/usb/caiaq/device.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c874db8a1d2f9f08161470d00cfe8db2f5cca2cc",
              "status": "affected",
              "version": "493b3a682ededc804555755f5d2193201339612d",
              "versionType": "git"
            },
            {
              "lessThan": "6fa8dff64fb6c401ced40a05797b327659317498",
              "status": "affected",
              "version": "dbcf7588e8dea017ddb3f18ec2766f7d2e5f2a0e",
              "versionType": "git"
            },
            {
              "lessThan": "a8d907acc3e5a078c2e5637ff60c30c6d2ddc23a",
              "status": "affected",
              "version": "ac7345f68cda6989016d85d63f7b244c064aa8f6",
              "versionType": "git"
            },
            {
              "lessThan": "50c6a1f05973f56d23280c9d7645a7a5734e0907",
              "status": "affected",
              "version": "f6634af5de728a46792f674a66d7843570cb68f7",
              "versionType": "git"
            },
            {
              "lessThan": "da3b8fd6a202d94fef11a443abc9171c52426a1c",
              "status": "affected",
              "version": "1d9be95aee6c6246a21752e60c9519902649f482",
              "versionType": "git"
            },
            {
              "lessThan": "6153878c5255bb69b7d0868105ca078ef13cbcf8",
              "status": "affected",
              "version": "6473ed16df1fe88051140611b3eb9a49be7f429e",
              "versionType": "git"
            },
            {
              "lessThan": "21ca595aafa40d3ac70eab1f4cb62cc00ca21657",
              "status": "affected",
              "version": "59b622a043cffc58b7638cd85ae6c30a0904f8e6",
              "versionType": "git"
            },
            {
              "lessThan": "7a5f1cd22d47f8ca4b760b6334378ae42c1bd24b",
              "status": "affected",
              "version": "80bb50e2d459213cccff3111d5ef98ed4238c0d5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/usb/caiaq/device.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6.6.140",
              "status": "affected",
              "version": "6.6.136",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.86",
              "status": "affected",
              "version": "6.12.84",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18.27",
              "status": "affected",
              "version": "6.18.25",
              "versionType": "semver"
            },
            {
              "lessThan": "7.0.4",
              "status": "affected",
              "version": "7.0.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "6.6.136",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.86",
                  "versionStartIncluding": "6.12.84",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.27",
                  "versionStartIncluding": "6.18.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.4",
                  "versionStartIncluding": "7.0.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: caiaq: fix usb_dev refcount leak on probe failure\n\ncreate_card() takes a reference on the USB device with usb_get_dev()\nand stores the matching usb_put_dev() in card_free(), which is\ninstalled as the snd_card\u0027s -\u003eprivate_free destructor.\n\nHowever, -\u003eprivate_free is only assigned near the end of init_card(),\nafter several failure points (usb_set_interface(), EP type checks,\nusb_submit_urb(), the EP1_CMD_GET_DEVICE_INFO exchange, and its\ntimeout). When any of those fail, init_card() returns an error to\nsnd_probe(), which calls snd_card_free(card). Because -\u003eprivate_free\nis still NULL, card_free() never runs, the usb_get_dev() reference\nis not dropped, and the struct usb_device leaks along with its\ndescriptor allocations and device_private.\n\nsyzbot reproduces this with a malformed UAC3 device whose only valid\naltsetting is 0; init_card()\u0027s usb_set_interface(usb_dev, 0, 1) call\nfails with -EIO and triggers the leak.\n\nMove the -\u003eprivate_free assignment into create_card(), immediately\nafter usb_get_dev(), so that every error path reaching snd_card_free()\nbalances the reference. card_free()\u0027s callees (snd_usb_caiaq_input_free,\nfree_urbs, kfree) already tolerate the partially-initialized state\nbecause the chip private area is zero-initialized by snd_card_new()."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-14T17:50:34.000Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c874db8a1d2f9f08161470d00cfe8db2f5cca2cc"
        },
        {
          "url": "https://git.kernel.org/stable/c/6fa8dff64fb6c401ced40a05797b327659317498"
        },
        {
          "url": "https://git.kernel.org/stable/c/a8d907acc3e5a078c2e5637ff60c30c6d2ddc23a"
        },
        {
          "url": "https://git.kernel.org/stable/c/50c6a1f05973f56d23280c9d7645a7a5734e0907"
        },
        {
          "url": "https://git.kernel.org/stable/c/da3b8fd6a202d94fef11a443abc9171c52426a1c"
        },
        {
          "url": "https://git.kernel.org/stable/c/6153878c5255bb69b7d0868105ca078ef13cbcf8"
        },
        {
          "url": "https://git.kernel.org/stable/c/21ca595aafa40d3ac70eab1f4cb62cc00ca21657"
        },
        {
          "url": "https://git.kernel.org/stable/c/7a5f1cd22d47f8ca4b760b6334378ae42c1bd24b"
        }
      ],
      "title": "ALSA: caiaq: fix usb_dev refcount leak on probe failure",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46048",
    "datePublished": "2026-05-27T12:57:04.477Z",
    "dateReserved": "2026-05-13T15:03:33.094Z",
    "dateUpdated": "2026-06-14T17:50:34.000Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-46048",
      "date": "2026-09-16",
      "epss": "0.00123",
      "percentile": "0.02361"
    },
    "microsoft_vex": {
      "current_release_date": "2026-06-09T14:47:53.000Z",
      "cve": "CVE-2026-46048",
      "id": "msrc_CVE-2026-46048",
      "initial_release_date": "2026-05-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ALSA: caiaq: fix usb_dev refcount leak on probe failure",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-46048.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-46048\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-27T14:17:24.310\",\"lastModified\":\"2026-06-17T10:52:57.833\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nALSA: caiaq: fix usb_dev refcount leak on probe failure\\n\\ncreate_card() takes a reference on the USB device with usb_get_dev()\\nand stores the matching usb_put_dev() in card_free(), which is\\ninstalled as the snd_card\u0027s -\u003eprivate_free destructor.\\n\\nHowever, -\u003eprivate_free is only assigned near the end of init_card(),\\nafter several failure points (usb_set_interface(), EP type checks,\\nusb_submit_urb(), the EP1_CMD_GET_DEVICE_INFO exchange, and its\\ntimeout). When any of those fail, init_card() returns an error to\\nsnd_probe(), which calls snd_card_free(card). Because -\u003eprivate_free\\nis still NULL, card_free() never runs, the usb_get_dev() reference\\nis not dropped, and the struct usb_device leaks along with its\\ndescriptor allocations and device_private.\\n\\nsyzbot reproduces this with a malformed UAC3 device whose only valid\\naltsetting is 0; init_card()\u0027s usb_set_interface(usb_dev, 0, 1) call\\nfails with -EIO and triggers the leak.\\n\\nMove the -\u003eprivate_free assignment into create_card(), immediately\\nafter usb_get_dev(), so that every error path reaching snd_card_free()\\nbalances the reference. card_free()\u0027s callees (snd_usb_caiaq_input_free,\\nfree_urbs, kfree) already tolerate the partially-initialized state\\nbecause the chip private area is zero-initialized by snd_card_new().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"sound/usb/caiaq/device.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"493b3a682ededc804555755f5d2193201339612d\",\"lessThan\":\"c874db8a1d2f9f08161470d00cfe8db2f5cca2cc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"dbcf7588e8dea017ddb3f18ec2766f7d2e5f2a0e\",\"lessThan\":\"6fa8dff64fb6c401ced40a05797b327659317498\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ac7345f68cda6989016d85d63f7b244c064aa8f6\",\"lessThan\":\"a8d907acc3e5a078c2e5637ff60c30c6d2ddc23a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f6634af5de728a46792f674a66d7843570cb68f7\",\"lessThan\":\"50c6a1f05973f56d23280c9d7645a7a5734e0907\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1d9be95aee6c6246a21752e60c9519902649f482\",\"lessThan\":\"da3b8fd6a202d94fef11a443abc9171c52426a1c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6473ed16df1fe88051140611b3eb9a49be7f429e\",\"lessThan\":\"6153878c5255bb69b7d0868105ca078ef13cbcf8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"59b622a043cffc58b7638cd85ae6c30a0904f8e6\",\"lessThan\":\"21ca595aafa40d3ac70eab1f4cb62cc00ca21657\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"80bb50e2d459213cccff3111d5ef98ed4238c0d5\",\"lessThan\":\"7a5f1cd22d47f8ca4b760b6334378ae42c1bd24b\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"sound/usb/caiaq/device.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.6.136\",\"lessThan\":\"6.6.140\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.12.84\",\"lessThan\":\"6.12.86\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.18.25\",\"lessThan\":\"6.18.27\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.0.2\",\"lessThan\":\"7.0.4\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-Other\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6.136\",\"versionEndExcluding\":\"6.6.140\",\"matchCriteriaId\":\"0FA1B944-78D8-45D7-A8B0-0B41685B6E78\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.12.84\",\"versionEndExcluding\":\"6.12.86\",\"matchCriteriaId\":\"68464024-93DF-45F6-A661-D6D7CB575D06\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.18.25\",\"versionEndExcluding\":\"6.18.27\",\"matchCriteriaId\":\"C56DF34F-56C3-4E5D-9497-241EAA95B3EC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.0.2\",\"versionEndExcluding\":\"7.0.4\",\"matchCriteriaId\":\"78E1B212-E5FF-4F46-B84D-FD98FCE5162B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B1EF7059-E670-45F4-B422-54C40FA86390\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/21ca595aafa40d3ac70eab1f4cb62cc00ca21657\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/50c6a1f05973f56d23280c9d7645a7a5734e0907\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6153878c5255bb69b7d0868105ca078ef13cbcf8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6fa8dff64fb6c401ced40a05797b327659317498\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7a5f1cd22d47f8ca4b760b6334378ae42c1bd24b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a8d907acc3e5a078c2e5637ff60c30c6d2ddc23a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c874db8a1d2f9f08161470d00cfe8db2f5cca2cc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/da3b8fd6a202d94fef11a443abc9171c52426a1c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-06-28T07:40:42+00:00",
      "cve": "CVE-2026-46048",
      "id": "CVE-2026-46048",
      "initial_release_date": "2026-05-27T00:00:00+00:00",
      "product_status:known_affected": "14",
      "product_status:known_not_affected": "260",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ALSA: caiaq: fix usb_dev refcount leak on probe failure",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46048.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T16:57:27Z",
      "cve": "CVE-2026-46048",
      "id": "CVE-2026-46048",
      "initial_release_date": "2026-05-28T03:53:42Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "324",
      "product_status:recommended": "254",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-46048",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-46048.json",
      "version": "11"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.