CVE-2026-31701

Vulnerability

The ALSA caiaq driver for Native Instruments USB audio devices stores a pointer to the parent USB device in cdev->chip.dev but never increments its reference count via usb_get_dev(). The card's private free callback, snd_usb_caiaq_card_free(), can execute, can run asynchronously through snd_card_free_when_closed() after the USB device has already been disconnected and freed. This results in a use-after-free when the callback accesses cdev->chip.dev [1.dev [1].

Exploitation

An attacker with physical access to the USB port could trigger the race condition by disconnecting the device while the sound card is still in use or being released. No special privileges are required beyond the ability to physically present user. The vulnerability is triggered during normal device removal, not through a crafted input [2].

Impact

A successful exploit could lead to a kernel crash (denial of service) or potentially arbitrary code execution in kernel context, depending on the memory state. The CVSS v3 score of 5.5 (Medium) reflects the need for physical access and the limited scope of confidentiality/integrity impact [3].

Mitigation

The fix, merged into the Linux kernel stable tree, adds usb_get_dev() in create_card() and usb_put_dev() in the free callback, and removes the inappropriate usb_reset_device() call that could cause further issues. Users should apply the latest kernel updates from their distribution [4].