CVE-2026-46048: Linux Kernel Privilege Escalation Flaw

CVE-2026-46048 Overview

CVE-2026-46048 is a resource management vulnerability in the Linux kernel's ALSA snd-usb-caiaq driver, which supports Native Instruments USB audio devices. The flaw causes a usb_dev reference count leak when probing fails during device initialization. The create_card() function acquires a USB device reference via usb_get_dev(), but the matching usb_put_dev() cleanup is registered as the snd_card's ->private_free destructor only near the end of init_card(). Failures occurring before that assignment leave the reference unreleased, leaking the struct usb_device, its descriptor allocations, and device_private state. The issue was reproduced by syzbot using a malformed UAC3 device.

Critical Impact
A local attacker with the ability to attach a malformed or malicious USB audio device can trigger repeated probe failures, causing kernel memory exhaustion through leaked USB device structures and associated allocations.

Affected Products

Linux kernel versions containing the snd-usb-caiaq driver prior to the fix
Distributions shipping vulnerable stable kernel branches referenced by the upstream commits
Systems with the ALSA caiaq driver loaded and USB device attachment available

Discovery Timeline

2026-05-27 - CVE-2026-46048 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-46048

Vulnerability Analysis

The vulnerability is a memory leak ([CWE-401]) in the sound/usb/caiaq/device.c initialization path. The create_card() function calls usb_get_dev() to take a reference on the USB device. The corresponding usb_put_dev() is wrapped inside card_free(), which is meant to run as the snd_card's ->private_free destructor.

The ordering bug is that ->private_free gets assigned only near the end of init_card(). Several failure points execute before that assignment, including usb_set_interface(), endpoint type checks, usb_submit_urb(), the EP1_CMD_GET_DEVICE_INFO exchange, and its timeout. When any of these fail, init_card() returns an error to snd_probe(), which calls snd_card_free(card). Because ->private_free remains NULL, card_free() never executes and the reference is never released.

Root Cause

The root cause is improper lifecycle management of the cleanup callback. The destructor responsible for releasing the USB device reference is installed too late in the initialization sequence, creating a window where multiple error paths bypass cleanup entirely.

Attack Vector

An attacker connects a malformed UAC3 (USB Audio Class 3) device whose only valid altsetting is 0. The driver's usb_set_interface(usb_dev, 0, 1) call fails with -EIO, returning early from init_card() before ->private_free is assigned. Each failed probe leaks one struct usb_device plus descriptor allocations and device_private. Repeated reconnection amplifies memory pressure on the host kernel.

The fix moves the ->private_free assignment into create_card(), immediately after usb_get_dev(), so every error path reaching snd_card_free() balances the reference correctly. Cleanup callees such as snd_usb_caiaq_input_free, free_urbs, and kfree already tolerate partially-initialized state because snd_card_new() zero-initializes the chip private area.

Detection Methods for CVE-2026-46048

Indicators of Compromise

Repeated snd-usb-caiaq probe failures in kernel logs, particularly usb_set_interface returning -EIO against UAC3 devices
Growing kmalloc slab usage tied to usb_device and USB descriptor caches without corresponding deallocations
Unexpected USB audio device connection events on systems that do not normally use Native Instruments hardware

Detection Strategies

Monitor dmesg and /var/log/kern.log for repeated caiaq initialization errors and ALSA card free events without matching device release messages
Track kernel slab statistics via /proc/slabinfo for unbounded growth in USB-related caches following USB attachment events
Audit USB device connection telemetry to identify anomalous repeated attach/detach cycles of audio class devices

Monitoring Recommendations

Enable USB device auditing through udev rules and forward attachment events to centralized logging
Correlate kernel error patterns with USB hotplug events to identify probe-failure abuse
Baseline normal kernel memory consumption and alert on sustained growth without workload justification

How to Mitigate CVE-2026-46048

Immediate Actions Required

Apply the upstream stable kernel patches that move ->private_free assignment into create_card() immediately after usb_get_dev()
Restrict physical and virtual USB device attachment on production and sensitive systems through USB allowlisting policies
Unload the snd-usb-caiaq module on systems that do not require Native Instruments USB audio support using modprobe -r snd_usb_caiaq

Patch Information

The fix is available in the upstream Linux kernel. Refer to the following commits: Kernel Git Commit 21ca595, Kernel Git Commit 50c6a1f, Kernel Git Commit 6153878, Kernel Git Commit 7a5f1cd, and Kernel Git Commit da3b8fd.

Workarounds

Blacklist the snd_usb_caiaq module on systems lacking a business need by adding blacklist snd_usb_caiaq to /etc/modprobe.d/
Enforce USB device authorization through the kernel's authorized_default interface to require explicit approval for new USB devices
Restrict physical access to USB ports on multi-user and server systems to reduce the malicious device attachment surface

bash

# Configuration example: blacklist the vulnerable module and require USB authorization
echo 'blacklist snd_usb_caiaq' | sudo tee /etc/modprobe.d/disable-caiaq.conf
sudo modprobe -r snd_usb_caiaq

# Require explicit authorization for new USB devices on a given bus
echo 0 | sudo tee /sys/bus/usb/devices/usb1/authorized_default