LiveActive security incident?Get immediate response
CVE Record

CVE-2026-46004: ALSA: caiaq: Handle probe errors properly

In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: Handle probe errors properly The probe procedure of setup_card() in caiaq driver doesn't treat the error cases gracefully, e.g. the error from snd_card_register() calls snd_card_free() but continues. This would lead to a UAF for the further calls like snd_usb_caiaq_control_init(), as Berk suggested in another patch in the link below. However, the problem is not only that; in general, this function drops the all error handlings (as it's a void function) although its caller can propagate an error to snd_probe(), which eventually calls snd_card_free() as a proper error path. That said, we should treat each error case in setup_card(), and just return the error code promptly, which is then handled later as a fatal error in snd_probe(). This patch achieves it by changing the setup_card() to return an error code. Also, the superfluous snd_card_free() call is removed, too. Note that card->private_free can be set still safely at returning an error. All called functions in card_free() have checks of the unassigned resources or NULL checks.

UnknownCVSS not scoredNot KEV-listedUpdated
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2026-46004 is a Linux kernel flaw in the ALSA caiaq audio driver. A failed device setup path can continue after freeing kernel structures, creating a use-after-free condition. The sources do not provide CVSS, impact scope, or active exploitation evidence.

Executive priority

Treat this as a patch-management item until severity is clarified. It affects kernel code, but the available evidence suggests narrower exposure than broadly remote Linux vulnerabilities. Prioritize confirmation on systems using affected kernels and the caiaq driver.

Technical view

The caiaq driver setup_card() routine mishandles probe errors. After snd_card_register() fails, it can call snd_card_free() yet continue into later initialization such as snd_usb_caiaq_control_init(), risking use-after-free. The fix changes setup_card() to return errors promptly and removes the extra free.

Likely exposure

Exposure appears limited to Linux systems with affected kernel versions where the ALSA caiaq driver is present and reachable through device probing. The bundle does not identify remote exposure, impacted distributions, or required hardware conditions beyond the driver path.

Exploitation context

The source bundle marks KEV as false and provides no evidence of public exploitation. It describes a kernel probe error-handling bug, but does not document attacker prerequisites, privilege requirements, or demonstrated impact.

Researcher notes

Key unknowns are exploitability, privilege boundary, affected distribution ranges, and whether device access is required. The upstream description clearly identifies the faulty error path and fix strategy, but does not assign CWE, CVSS, or exploitation status.

Mitigation direction

  • Apply Linux kernel updates that include the referenced stable caiaq fixes.
  • Use distribution vendor advisories to identify fixed kernel package versions.
  • Prioritize systems where the caiaq driver is built, loadable, or used.
  • If updates are unavailable, request vendor guidance for supported interim controls.
  • Do not rely on unverified workarounds not named by the vendor.

Validation and detection

  • Inventory running kernel versions against vendor fixed package data.
  • Check kernel configuration or module inventory for the caiaq driver.
  • Confirm the relevant stable fix commit is present in custom kernels.
  • Review update status across endpoints and audio-capable Linux systems.
  • Track CVE and vendor advisories for later CVSS or impact details.
Prepared
Confidence
medium
Sources
10

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-46004 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
9Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux8e3cd08ed8e590952aa9a656758cb24d4ba898f8, 8e3cd08ed8e590952aa9a656758cb24d4ba898f8, 8e3cd08ed8e590952aa9a656758cb24d4ba898f8, 8e3cd08ed8e590952aa9a656758cb24d4ba898f8, 8e3cd08ed8e590952aa9a656758cb24d4ba898f8, 8e3cd08ed8e590952aa9a656758cb24d4ba898f8, 8e3cd08ed8e590952aa9a656758cb24d4ba898f8, 8e3cd08ed8e590952aa9a656758cb24d4ba898f8unaffected
LinuxLinux2.6.25, 0, 5.10.258, 5.15.209, 6.1.175, 6.6.140, 6.12.86, 6.18.27, 7.0.4, 7.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.