CVE-2026-31701

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture (ALSA) caiaq driver. This vulnerability arises from improper handling of Universal Serial Bus (USB) device references. When a USB device is disconnected, the driver may attempt to access memory that has already been freed, a condition known as use-after-free. This can lead to system instability, crashes, or potentially allow a local attacker to execute arbitrary code.

The caiaq USB-audio driver now holds a refcount on the USB device during card creation so teardown cannot race a disappearing bus. Red Hat recommends kernel updates for this hardware; optional mitigation is unloading snd_usb_caiaq where unused.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the snd_usb_caiaq module from being loaded. See https://access.redhat.com/solutions/41278 for instructions.