CVE-2026-31701

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: caiaq: take a reference on the USB device in create_card()

The caiaq driver stores a pointer to the parent USB device in

cdev->chip.dev but never takes a reference on it. The card's

private_free callback, snd_usb_caiaq_card_free(), can run

asynchronously via snd_card_free_when_closed() after the USB

device has already been disconnected and freed, so any access to

cdev->chip.dev in that path dereferences a freed usb_device.

On top of the refcounting issue, the current card_free implementation

calls usb_reset_device(cdev->chip.dev). A reset in a free callback

is inappropriate: the device is going away, the call takes the

device lock in a teardown context, and the reset races with the

disconnect path that the callback is already cleaning up after.

Take a reference on the USB device in create_card() with

usb_get_dev(), drop it with usb_put_dev() in the free callback,

and remove the usb_reset_device() call.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References