CVE-2026-98066

A flaw was found in the Linux kernel's ALSA (Advanced Linux Sound Architecture) caiaq USB audio driver. A local user could exploit this vulnerability to cause a Denial of Service (DoS) or memory corruption by triggering an initialization failure. The issue stems from improper resource management in the driver's error-handling path, which allows previously released memory buffers to be freed a second time.

A double-free can occur in the ALSA caiaq audio initialization error path because previously released URB or callback resources may remain referenced by non-NULL pointers and can be released again during later cleanup. Triggering requires a caiaq USB device or a suitable emulated USB device together with an initialization failure that reaches the affected cleanup sequence. For the CVSS the PR:N value is used because an attacker who can physically attach a crafted USB device does not need an authenticated local account or existing privileges on the target. The issue is not network reachable and the realistic attack vector is physical access to the USB interface. Impact is at least denial of service through kernel memory corruption and a kernel crash. In the paranoid case the double-free may permit broader confidentiality and integrity impact or kernel code execution if the freed allocation can be reclaimed and controlled, although a reliable privilege escalation path is not demonstrated.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.