{"id":29161,"date":"2026-09-25T20:32:01","date_gmt":"2026-09-25T12:32:01","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98006"},"modified":"2026-09-25T20:32:01","modified_gmt":"2026-09-25T12:32:01","slug":"cve-2026-98006","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98006","title":{"rendered":"CVE-2026-98006 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: caiaq: Decoupli"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev<\/p>\n<p>The epq_in_urb object belonging to the caiaq device is coupled within<br \/>\nthe struct snd_usb_caiaqdev. After usb_submit_urb(epq_in_urb, GFP_KERNEL)<br \/>\nexecutes successfully, epq_in_urb is successfully added to the urbp_list<br \/>\nqueue of the dummy HCD driver (userspace specifies dummy_hcd as the HCD<br \/>\nlayer driver for the caiaq USB device).<\/p>\n<p>When init_card() calls snd_usb_caiaq_send_command() which subsequently<br \/>\nfails due to a timeout, and proceeds to call snd_card_free() to release<br \/>\nthe card, the embedded ep1_in_urb object is also freed. When the dummy<br \/>\nHCD driver detects that the URB has been unlinked, it returns the URB<br \/>\n(by usb_hcd_giveback_urb()), which triggers [1].<\/p>\n<p>Decouple the ep1_in_urb object from the struct snd_usb_caiaqdev and switch<br \/>\nto using a pointer instead. Separately allocate and manage the memory for<br \/>\nep1_in_urb to prevent the release of the snd_card memory object from<br \/>\ninterfering with it.<\/p>\n<p>midi_out_urb has the same issue as ep1_in_urb and is handled in the same<br \/>\nway.<\/p>\n<p>[1]<br \/>\nBUG: KASAN: slab-use-after-free in usb_free_urb+0x24\/0x120 drivers\/usb\/core\/urb.c:96<br \/>\nWrite of size 4 at addr ffff88803cee1050 by task ktimers\/1\/29<br \/>\nCall Trace:<br \/>\n usb_free_urb+0x24\/0x120 drivers\/usb\/core\/urb.c:96<br \/>\n dummy_timer+0xaac\/0x4d50 drivers\/usb\/gadget\/udc\/dummy_hcd.c:2019<br \/>\n __run_hrtimer kernel\/time\/hrtimer.c:2067 [inline]<br \/>\n __hrtimer_run_queues+0x3eb\/0xaf0 kernel\/time\/hrtimer.c:2124<br \/>\n hrtimer_run_softirq+0x1e1\/0x2e0 kernel\/time\/hrtimer.c:2141<\/p>\n<p>Allocated by task 36:<br \/>\n snd_card_new+0x7b\/0x110 sound\/core\/init.c:184<br \/>\n create_card sound\/usb\/caiaq\/device.c:429 [inline]<br \/>\n snd_probe+0x236\/0x1af0 sound\/usb\/caiaq\/device.c:544<\/p>\n<p>Freed by task 36:<br \/>\n snd_card_free_when_closed sound\/core\/init.c:630 [inline]<br \/>\n snd_card_free+0x138\/0x1d0 sound\/core\/init.c:662<br \/>\n snd_probe+0x162b\/0x1af0 sound\/usb\/caiaq\/device.c:553<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev<\/p>\n<p>The epq_in_urb object belonging to the caiaq device is coupled within<br \/>\nthe struct s<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29161","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29161","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29161"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29161"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29161"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}