In the Linux kernel, the following vulnerability has been resolved:
ALSA: caiaq: Handle probe errors properly
The probe procedure of setup_card() in caiaq driver doesn't treat the
error cases gracefully, e.g. the error from snd_card_register() calls
snd_card_free() but continues. This would lead to a UAF for the
further calls like snd_usb_caiaq_control_init(), as Berk suggested in
another patch in the link below.
However, the problem is not only that; in general, this function drops
the all error handlings (as it's a void function) although its caller
can propagate an error to snd_probe(), which eventually calls
snd_card_free() as a proper error path. That said, we should treat
each error case in setup_card(), and just return the error code
promptly, which is then handled later as a fatal error in snd_probe().
This patch achieves it by changing the setup_card() to return an error
code. Also, the superfluous snd_card_free() call is removed, too.
Note that card->private_free can be set still safely at returning an
error. All called functions in card_free() have checks of the
unassigned resources or NULL checks.
Security readout for executives and security teams
Plain-English summary
CVE-2026-46004 is a Linux kernel flaw in the ALSA caiaq audio driver. A failed device setup path can continue after freeing kernel structures, creating a use-after-free condition. The sources do not provide CVSS, impact scope, or active exploitation evidence.
Executive priority
Treat this as a patch-management item until severity is clarified. It affects kernel code, but the available evidence suggests narrower exposure than broadly remote Linux vulnerabilities. Prioritize confirmation on systems using affected kernels and the caiaq driver.
Technical view
The caiaq driver setup_card() routine mishandles probe errors. After snd_card_register() fails, it can call snd_card_free() yet continue into later initialization such as snd_usb_caiaq_control_init(), risking use-after-free. The fix changes setup_card() to return errors promptly and removes the extra free.
Likely exposure
Exposure appears limited to Linux systems with affected kernel versions where the ALSA caiaq driver is present and reachable through device probing. The bundle does not identify remote exposure, impacted distributions, or required hardware conditions beyond the driver path.
Exploitation context
The source bundle marks KEV as false and provides no evidence of public exploitation. It describes a kernel probe error-handling bug, but does not document attacker prerequisites, privilege requirements, or demonstrated impact.
Researcher notes
Key unknowns are exploitability, privilege boundary, affected distribution ranges, and whether device access is required. The upstream description clearly identifies the faulty error path and fix strategy, but does not assign CWE, CVSS, or exploitation status.
Mitigation direction
Apply Linux kernel updates that include the referenced stable caiaq fixes.
Use distribution vendor advisories to identify fixed kernel package versions.
Prioritize systems where the caiaq driver is built, loadable, or used.
If updates are unavailable, request vendor guidance for supported interim controls.
Do not rely on unverified workarounds not named by the vendor.
Validation and detection
Inventory running kernel versions against vendor fixed package data.
Check kernel configuration or module inventory for the caiaq driver.
Confirm the relevant stable fix commit is present in custom kernels.
Review update status across endpoints and audio-capable Linux systems.
Track CVE and vendor advisories for later CVSS or impact details.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2026-46004 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
0CVSS vectors
3Timeline events
0ADP providers
9Source links
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
CVE publishedCVE Program
The CVE record was published.
May 27, 2026, 12:56 UTC (UTC+00:00)
CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.