# CVE-2026-98837: ALSA: caiaq: unregister the input device when probe fails

> A use-after-free vulnerability in the ALSA caiaq driver allows local attackers to cause a system crash or potentially execute code by triggering a probe failure.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 18 Oct 2026
- **Updated:** 21 Oct 2026
- **Also known as:** AZL-108866, BELL-CVE-2026-98837, DEBIAN-CVE-2026-98837, GHSA-gvp5-mg7r-w29g, UBUNTU-CVE-2026-98837

## What is CVE-2026-98837?

CVE-2026-98837 is an use after free vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: caiaq: unregister the input device when probe fails

setup_card() registers the input device, whose name and phys point into
struct snd_usb_caiaqdev, and then goes on to snd_card_register() and
snd_usb_caiaq_control_init(). If either fails, snd_probe() calls
snd_card_free(), which frees the device state but leaves the input
device registered: card_free() only clears the pointer, and the input
device is unregistered from snd_disconnect() alone. Reading its "uevent"
attribute afterwards dereferences freed memory:

  BUG: KASAN: slab-use-after-free in string+0x4a9/0x4f0
  Read of size 1 at addr ffff8880208f5043 by task caiaq/4967
   add_uevent_var+0x183/0x3a0
   input_dev_uevent+0x162/0x900
   dev_uevent+0x2f1/0x870
   uevent_show+0x1ca/0x3a0
   ...

Unregister the input device on the probe error path, as
snd_disconnect() does. snd_usb_caiaq_input_disconnect() is a no-op when
no input device was registered.

Reproduced with a raw-gadget Audio Kontrol 1 and a temporary hack that
makes snd_usb_caiaq_control_init() fail.

## Which versions are affected by CVE-2026-98837?


## How do I fix CVE-2026-98837?

Apply the vendor's patch.

## Is CVE-2026-98837 being exploited?

There is no known exploitation of CVE-2026-98837 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-98837 and fix it if it is affected.

What it is: CVE-2026-98837 is an use after free vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-98837 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-98837/ (Markdown: https://insights.sbomify.com/CVE-2026-98837/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-98837
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-98837
- OSV: https://osv.dev/vulnerability/CVE-2026-98837

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-98837/
Summaries are generated and may contain mistakes; the official description above is the record.