CVE-2026-98837

In the Linux kernel, the following vulnerability has been resolved:

ALSA: caiaq: unregister the input device when probe fails

setup card() registers the input device, whose name and phys point into struct snd usb caiaqdev, and then goes on to snd card register() and snd usb caiaq control init(). If either fails, snd probe() calls snd card free(), which frees the device state but leaves the input device registered: card free() only clears the pointer, and the input device is unregistered from snd disconnect() alone. Reading its "uevent" attribute afterwards dereferences freed memory:

BUG: KASAN: slab-use-after-free in string+0x4a9/0x4f0 Read of size 1 at addr ffff8880208f5043 by task caiaq/4967 add uevent var+0x183/0x3a0 input dev uevent+0x162/0x900 dev uevent+0x2f1/0x870 uevent show+0x1ca/0x3a0 ...

Unregister the input device on the probe error path, as snd disconnect() does. snd usb caiaq input disconnect() is a no-op when no input device was registered.

Reproduced with a raw-gadget Audio Kontrol 1 and a temporary hack that makes snd usb caiaq control init() fail.