CVE-2026-46004 Details

A vulnerability in the Linux kernel's ALSA Caiaq driver has been identified, where the probe procedure in the setup_card() function fails to manage errors properly. Specifically, while the snd_card_register() function's failure prompts a call to snd_card_free(), the process continues instead of halting. This oversight can lead to a use-after-free condition in subsequent function calls, such as snd_usb_caiaq_control_init(). Additionally, the setup_card() function, being a void function, neglects to handle errors appropriately, even though its caller can relay errors to snd_probe(), which would normally invoke snd_card_free() as part of the error management process. The vulnerability arises because the setup_card() function does not return error codes, leaving error handling to be managed later in the snd_probe() function. This patch addresses the issue by modifying setup_card() to return an error code, allowing for proper error propagation and handling. The unnecessary snd_card_free() call has also been removed, while still permitting the safe assignment of card->private_free in case of an error.

Users can upgrade to the patched version of the Linux kernel where this vulnerability has been addressed. The specific commit containing the fix can be downloaded from the Linux kernel stable tree.