CVE-2026-31701
Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: take a reference on the USB device in create_card() The caiaq driver stores a pointer to the parent USB device in cdev->chip.dev but never takes a reference on it. The card's private_free callback, snd_usb_caiaq_card_free(), can run asynchronously via snd_card_free_when_closed() after the USB device has already been disconnected and freed, so any access to cdev->chip.dev in that path dereferences a freed usb_device. On top of the refcounting issue, the current card_free implementation calls usb_reset_device(cdev->chip.dev). A reset in a free callback is inappropriate: the device is going away, the call takes the device lock in a teardown context, and the reset races with the disconnect path that the callback is already cleaning up after. Take a reference on the USB device in create_card() with usb_get_dev(), drop it with usb_put_dev() in the free callback, and remove the usb_reset_device() call.
How to fix
- linux linux_kernel6.18.25, 7.0.2 or later
- git.kernel.org/stable/c/1d9be95aee6c6246a21752e60c9519902649f482
- git.kernel.org/stable/c/59b622a043cffc58b7638cd85ae6c30a0904f8e6
- git.kernel.org/stable/c/6473ed16df1fe88051140611b3eb9a49be7f429e
- git.kernel.org/stable/c/80bb50e2d459213cccff3111d5ef98ed4238c0d5
- git.kernel.org/stable/c/f6634af5de728a46792f674a66d7843570cb68f7
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | 6.13 ≤ v < 6.18.25, 6.19 ≤ v < 7.0.2, 6.13, 7.1 | 6.18.25, 7.0.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.