CVE-2026-46048

A flaw was found in the Linux kernel's ALSA caiaq driver. This vulnerability, a reference count leak, occurs when the create_card() function acquires a reference to a USB device, but the corresponding release is not performed if init_card() fails before the destructor is properly assigned. A local attacker with a malformed Universal Audio Class 3 (UAC3) device could exploit this to cause a resource leak, potentially leading to a denial of service due to system resource exhaustion.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.