CVE-2026-46004 Overview
CVE-2026-46004 is a Linux kernel vulnerability in the ALSA caiaq USB audio driver. The flaw lives in the setup_card() probe routine, which fails to handle errors from snd_card_register() and related calls. When registration fails, snd_card_free() is invoked but execution continues, leaving freed structures in use by subsequent calls such as snd_usb_caiaq_control_init(). This results in a use-after-free (UAF) condition during device probe.
Critical Impact
A use-after-free in the kernel probe path for Native Instruments caiaq USB audio devices can corrupt kernel memory and destabilize the host when a malformed or failing device is attached.
Affected Products
- Linux kernel — ALSA snd-usb-caiaq driver (sound/usb/caiaq)
- Stable kernel branches referenced by the upstream fix commits
- Distributions shipping the affected driver prior to the merged patches
Discovery Timeline
- 2026-05-27 - CVE CVE-2026-46004 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-46004
Vulnerability Analysis
The setup_card() function in the caiaq driver is declared as void, so it cannot propagate errors to its caller. When snd_card_register() fails, the driver invokes snd_card_free() to release the sound card structure, but then continues executing the rest of setup_card(). Subsequent helpers, including snd_usb_caiaq_control_init(), dereference memory that has already been freed.
This is a classic use-after-free [CWE-416] reachable from the USB probe path. The driver also lacks a clean error path, since the parent function cannot return an error to snd_probe(), which would otherwise call snd_card_free() as the canonical cleanup.
The upstream fix changes setup_card() to return an int error code, removes the redundant in-function snd_card_free() call, and lets snd_probe() perform proper teardown. The fix also relies on card->private_free being safe to set even on the error return, because all helpers invoked from card_free() already null-check their resources.
Root Cause
The root cause is improper error handling in a probe-time initialization function. By dropping return values and freeing the card object without aborting the remainder of the routine, the driver creates a window where freed memory is read and written by follow-on initialization code.
Attack Vector
Triggering the flaw requires the caiaq driver to attempt probing on a USB device matching its supported IDs and for snd_card_register() (or a preceding step) to fail. An attacker with physical access, or control over a malicious or malfunctioning USB device, could induce this condition. Remote exploitation is not described in the advisory.
No public proof-of-concept code is referenced for this issue. See the upstream commits for the exact code paths and patch diff.
Detection Methods for CVE-2026-46004
Indicators of Compromise
- Kernel oops or panic traces referencing snd_usb_caiaq_control_init, setup_card, or snd_card_free in dmesg and /var/log/kern.log.
- KASAN reports identifying a use-after-free in the snd-usb-caiaq module during USB device probe.
- Unexpected unloads or repeated probe failures of the snd-usb-caiaq module after attaching a USB audio device.
Detection Strategies
- Monitor kernel logs for ALSA caiaq probe failures correlated with USB hot-plug events.
- Inventory hosts running kernels that still ship the unpatched snd-usb-caiaq driver, using package versions and modinfo snd-usb-caiaq.
- Audit physical and virtualized USB pass-through configurations where untrusted USB audio devices may be attached.
Monitoring Recommendations
- Forward kernel ring buffer output to centralized logging and alert on snd_usb_caiaq, KASAN, or use-after-free strings.
- Track USB device attach and detach events on servers and workstations that should not normally see audio class devices.
- Review crash dumps from kernel panics for stack frames within sound/usb/caiaq/.
How to Mitigate CVE-2026-46004
Immediate Actions Required
- Apply the stable kernel updates that include the upstream fix commits to all affected Linux systems.
- On systems where caiaq hardware is not used, blacklist the module to remove the attack surface entirely.
- Restrict physical access and USB device attachment on production servers and shared workstations.
Patch Information
The vulnerability is resolved upstream in the Linux kernel. The fix reworks setup_card() to return error codes and removes the redundant snd_card_free() call. Relevant commits include Linux Kernel Commit 096dd85, Linux Kernel Commit 28abd22, Linux Kernel Commit 6251e3e, Linux Kernel Commit e59ecd4, and Linux Kernel Commit f537e3a. Apply the patch corresponding to your stable branch.
Workarounds
- Blacklist the driver by adding blacklist snd-usb-caiaq to /etc/modprobe.d/blacklist-caiaq.conf and rebuilding the initramfs.
- Use USB device authorization policies to deny attachment of audio class devices on systems that do not require them.
- Limit physical access to the system to trusted operators until the patched kernel is deployed.
# Configuration example
echo 'blacklist snd-usb-caiaq' | sudo tee /etc/modprobe.d/blacklist-caiaq.conf
sudo rmmod snd_usb_caiaq 2>/dev/null || true
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
