CVE-2026-45992: Linux Kernel ALSA URB Leak Vulnerability

CVE-2026-45992 Overview

CVE-2026-45992 affects the Linux kernel ALSA (Advanced Linux Sound Architecture) caiaq driver, which handles Native Instruments USB audio devices. The flaw is a resource leak in the error handling path of the driver's initialization routine. When setup_card() fails, the driver does not cancel the internal USB Request Block (URB) cdev->ep1_in_urb that may have been submitted earlier. Under normal disconnection flow, this URB is killed, but the error path overlooks it, leaving a potential leftover URB referencing freed driver state.

Critical Impact

A leftover in-flight URB in the caiaq driver error path can lead to memory leaks and potential use-after-free conditions when the USB device is disconnected or re-enumerated after a failed setup.

Affected Products

• Linux kernel — sound/usb/caiaq driver (ALSA caiaq subsystem)
• Stable kernel branches receiving the backported fix commits referenced in the advisory
• Distributions shipping the affected kernel versions prior to the patch

Discovery Timeline

• 2026-05-27 - CVE-2026-45992 published to NVD
• 2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45992

Vulnerability Analysis

The caiaq driver in the Linux kernel manages USB-attached Native Instruments audio controllers. During probe, the driver allocates and submits an internal URB (cdev->ep1_in_urb) to receive data from endpoint 1 before completing card setup via setup_card(). A prior fix added error handling for setup_card() failures, but it did not account for the case where ep1_in_urb had already been submitted to the USB core.

When setup_card() returns an error, the cleanup path frees driver structures without calling usb_kill_urb() on ep1_in_urb. The URB remains in flight, referencing memory that may be released. On completion, the in-flight URB can dereference freed structures, producing a memory leak at minimum and a potential use-after-free under race conditions.

Root Cause

The root cause is incomplete error-path cleanup in the caiaq probe sequence. The original error handler released allocated resources but omitted the usb_kill_urb() call required to reclaim the previously submitted ep1_in_urb. This is a classic asymmetry between the success/disconnect path, which kills the URB, and the failure path, which does not.

Attack Vector

Triggering the flaw requires a caiaq-compatible USB device, either physically attached or emulated, that causes setup_card() to fail after ep1_in_urb has been submitted. An attacker with physical access or the ability to attach crafted USB devices, such as through a USB gadget, could reproduce the condition. Remote exploitation is not applicable to this driver-level resource leak.

The vulnerability is described in the upstream commits referenced in the Linux Kernel Commit 0a7b522, Linux Kernel Commit 1d160e30, Linux Kernel Commit 438ab932, Linux Kernel Commit be62c8bb, and Linux Kernel Commit e0fb842a. No public proof-of-concept exploit is available.

Detection Methods for CVE-2026-45992

Indicators of Compromise

• Kernel log entries from the snd-usb-caiaq module indicating setup_card() failure during USB device probe.
• Unexpected memory growth in kmalloc slabs associated with USB URB structures after repeated insertion of caiaq devices.
• KASAN (Kernel Address Sanitizer) or kmemleak reports referencing ep1_in_urb allocations in the caiaq driver path.

Detection Strategies

• Audit running kernel versions across Linux endpoints and servers to identify hosts running unpatched caiaq driver builds.
• Enable kmemleak on test systems to surface URB-related leaks tied to the ALSA caiaq subsystem.
• Monitor dmesg for ALSA initialization errors followed by USB disconnect events without corresponding URB completion.

Monitoring Recommendations

• Track USB device attach and detach events on systems where snd-usb-caiaq is loaded, particularly in shared or kiosk environments.
• Forward kernel logs to a centralized analytics platform and alert on repeated probe failures for the caiaq module.
• Include kernel package versions in asset inventory to confirm patch deployment status.

How to Mitigate CVE-2026-45992

Immediate Actions Required

• Update the Linux kernel to a version containing the fix commits listed in the NVD advisory.
• If patching is not immediately possible, blacklist the snd-usb-caiaq module on systems that do not require Native Instruments USB audio hardware.
• Restrict physical USB access on systems where untrusted USB devices could be connected.

Patch Information

The fix adds a usb_kill_urb() call for cdev->ep1_in_urb in the setup_card() error path, ensuring the in-flight URB is canceled before driver state is released. Patches are available in the stable Linux kernel commits 0a7b5221, 1d160e30, 438ab932, be62c8bb, and e0fb842a referenced in the advisory. Apply the kernel update provided by your Linux distribution vendor.

Workarounds

• Unload and blacklist the snd-usb-caiaq kernel module on hosts that do not use Native Instruments USB audio devices.
• Enforce USB device authorization policies through udev rules to reject unknown USB audio devices.
• Limit physical access to endpoints where USB attack surface cannot be reduced through software controls.

# Blacklist the affected ALSA caiaq module until the kernel is patched
echo "blacklist snd-usb-caiaq" | sudo tee /etc/modprobe.d/blacklist-caiaq.conf
sudo modprobe -r snd-usb-caiaq
sudo update-initramfs -u