LiveActive security incident?Get immediate response
CVE Record

CVE-2026-31701: ALSA: caiaq: take a reference on the USB device in create_card()

In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: take a reference on the USB device in create_card() The caiaq driver stores a pointer to the parent USB device in cdev->chip.dev but never takes a reference on it. The card's private_free callback, snd_usb_caiaq_card_free(), can run asynchronously via snd_card_free_when_closed() after the USB device has already been disconnected and freed, so any access to cdev->chip.dev in that path dereferences a freed usb_device. On top of the refcounting issue, the current card_free implementation calls usb_reset_device(cdev->chip.dev). A reset in a free callback is inappropriate: the device is going away, the call takes the device lock in a teardown context, and the reset races with the disconnect path that the callback is already cleaning up after. Take a reference on the USB device in create_card() with usb_get_dev(), drop it with usb_put_dev() in the free callback, and remove the usb_reset_device() call.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2026-31701 is a Linux kernel bug in the ALSA caiaq USB audio driver. During device removal, cleanup code can later use a USB device pointer after the device has already been freed. Business impact depends heavily on whether affected systems use this driver and allow relevant USB device interaction.

Executive priority

Treat this as a targeted Linux kernel maintenance item, not a confirmed emergency. Prioritize patch validation on endpoints or appliances where users can attach USB audio devices, and rely on vendor kernel advisories for final remediation status.

Technical view

The caiaq driver stores the parent usb_device pointer without taking a reference. snd_usb_caiaq_card_free() may run asynchronously after disconnect via snd_card_free_when_closed(), causing a freed usb_device dereference. The fix takes and drops a USB device reference and removes usb_reset_device() from the free callback.

Likely exposure

Exposure appears limited to Linux systems with the ALSA caiaq driver present and reachable through relevant USB audio hardware paths. The CVE bundle does not provide CVSS, CWE, exploitability, or distribution-specific package mappings, so fleet exposure requires kernel and vendor backport validation.

Exploitation context

The bundle does not cite active exploitation, public exploit code, or KEV inclusion. The described condition is a kernel use-after-free during USB device disconnect and asynchronous sound-card cleanup, but the sources do not establish practical exploitability or privilege impact.

Researcher notes

The key issue is lifetime management: cdev->chip.dev lacked usb_get_dev()/usb_put_dev() pairing, and cleanup could access a freed usb_device. The source also flags usb_reset_device() in private_free as inappropriate because teardown can race with disconnect locking.

Mitigation direction

  • Apply vendor kernel updates that include the referenced stable fixes.
  • Map distribution kernels to the upstream stable commits before declaring systems fixed.
  • Limit access to untrusted relevant USB audio devices until patched.
  • Track Linux and distribution advisories for corrected package versions.

Validation and detection

  • Inventory Linux kernel versions across affected assets.
  • Check whether the ALSA caiaq driver is built, loaded, or packaged.
  • Confirm fixed upstream commits or vendor backports are present.
  • Prioritize systems where USB peripherals are user-accessible or exposed operationally.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-31701 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
9Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux4dd821dcbfcecf7af6a08370b0b217cde2818acf, cadf1d8e9ddcd74584ec961aeac14ac549b261d8, 237f3faf0177bdde728fa3106d730d806436aa4d, 4507a8b9b30344c5ddd8219945f446d47e966a6d, a3f9314752dbb6f6aa1f0f2b4c58243bda800738, b04dcbb7f7b1908806b7dc22671cdbe78ff2b82c, b04dcbb7f7b1908806b7dc22671cdbe78ff2b82c, b04dcbb7f7b1908806b7dc22671cdbe78ff2b82c, 3993edf44d3df7b6e8c753eac6ac8783473fcbab, ebad462eec93b0f701dfe4de98990e7355283801, dd0de8cb708951cebf727aa045e8242ba651bb52, 5.10.231, 5.15.174, 6.1.120, 6.6.64, 6.12.2, 4.19.325, 5.4.287, 6.11.11unaffected
LinuxLinux6.13, 0, 5.10.258, 5.15.209, 6.1.175, 6.6.136, 6.12.84, 6.18.25, 7.0.2, 7.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.