CVE-2026-46048

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: caiaq: fix usb_dev refcount leak on probe failure

create_card() takes a reference on the USB device with usb_get_dev()

and stores the matching usb_put_dev() in card_free(), which is

installed as the snd_card's ->private_free destructor.

However, ->private_free is only assigned near the end of init_card(),

after several failure points (usb_set_interface(), EP type checks,

usb_submit_urb(), the EP1_CMD_GET_DEVICE_INFO exchange, and its

timeout). When any of those fail, init_card() returns an error to

snd_probe(), which calls snd_card_free(card). Because ->private_free

is still NULL, card_free() never runs, the usb_get_dev() reference

is not dropped, and the struct usb_device leaks along with its

descriptor allocations and device_private.

syzbot reproduces this with a malformed UAC3 device whose only valid

altsetting is 0; init_card()'s usb_set_interface(usb_dev, 0, 1) call

fails with -EIO and triggers the leak.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References