CVE-2026-46048ALSA: caiaq: fix usb_dev refcount leak on probe failure
- 5.5MediumCVSS base score
- 0.12%Exploitation in 30 daysEPSS · top 98% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: fix usb_dev refcount leak on probe failure create_card() takes a reference on the USB device with usb_get_dev() and stores the matching usb_put_dev() in card_free(), which is installed as the snd_card's ->private_free destructor. However, ->private_free is only assigned near the end of init_card(), after several failure points (usb_set_interface(), EP type checks, usb_submit_urb(), the EP1_CMD_GET_DEVICE_INFO exchange, and its timeout). When any of those fail, init_card() returns an error to snd_probe(), which calls snd_card_free(card). Because ->private_free is still NULL, card_free() never runs, the usb_get_dev() reference is not dropped, and the struct usb_device leaks along with its descriptor allocations and device_private. syzbot reproduces this with a malformed UAC3 device whose only valid altsetting is 0; init_card()'s usb_set_interface(usb_dev, 0, 1) call fails with -EIO and triggers the leak. Move the ->private_free assignment into create_card(), immediately after usb_get_dev(), so that every error path reaching snd_card_free() balances the reference. card_free()'s callees (snd_usb_caiaq_input_free, free_urbs, kfree) already tolerate the partially-initialized state because the chip private area is zero-initialized by snd_card_new().
Timeline
ID reserved
By Linux
- 14 days later
· 14 days later
Published
- 18 days later
· 18 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Analyzed | 3.1 | Medium5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.12% · top 98% of all CVEs (14 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.5.
Affected products
- affected 493b3a682ededc804555755f5d2193201339612d – < c874db8a1d2f9f08161470d00cfe8db2f5cca2cc
- affected dbcf7588e8dea017ddb3f18ec2766f7d2e5f2a0e – < 6fa8dff64fb6c401ced40a05797b327659317498
- affected ac7345f68cda6989016d85d63f7b244c064aa8f6 – < a8d907acc3e5a078c2e5637ff60c30c6d2ddc23a
- affected f6634af5de728a46792f674a66d7843570cb68f7 – < 50c6a1f05973f56d23280c9d7645a7a5734e0907
- affected 1d9be95aee6c6246a21752e60c9519902649f482 – < da3b8fd6a202d94fef11a443abc9171c52426a1c
- affected 6473ed16df1fe88051140611b3eb9a49be7f429e – < 6153878c5255bb69b7d0868105ca078ef13cbcf8
- affected 59b622a043cffc58b7638cd85ae6c30a0904f8e6 – < 21ca595aafa40d3ac70eab1f4cb62cc00ca21657
- affected 80bb50e2d459213cccff3111d5ef98ed4238c0d5 – < 7a5f1cd22d47f8ca4b760b6334378ae42c1bd24b
- affected 6.6.136 – < 6.6.140
- affected 6.12.84 – < 6.12.86
- affected 6.18.25 – < 6.18.27
- affected 7.0.2 – < 7.0.4
References
References8
- https://git.kernel.org/stable/c/c874db8a1d2f9f08161470d00cfe8db2f5cca2cc (opens in a new tab)
- https://git.kernel.org/stable/c/6fa8dff64fb6c401ced40a05797b327659317498 (opens in a new tab)
- https://git.kernel.org/stable/c/a8d907acc3e5a078c2e5637ff60c30c6d2ddc23a (opens in a new tab)
- https://git.kernel.org/stable/c/50c6a1f05973f56d23280c9d7645a7a5734e0907 (opens in a new tab)
- https://git.kernel.org/stable/c/da3b8fd6a202d94fef11a443abc9171c52426a1c (opens in a new tab)
- https://git.kernel.org/stable/c/6153878c5255bb69b7d0868105ca078ef13cbcf8 (opens in a new tab)
- https://git.kernel.org/stable/c/21ca595aafa40d3ac70eab1f4cb62cc00ca21657 (opens in a new tab)
- https://git.kernel.org/stable/c/7a5f1cd22d47f8ca4b760b6334378ae42c1bd24b (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-32430 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-46048)Record last updated .