Answer in brief
CVE-2026-31701 records a Unknown severity vulnerability in ALSA: caiaq: take a reference on the USB device in create_card(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=4dd821dcbfcecf7af6a08370b0b217cde2818acf <493b3a682ededc804555755f5d2193201339612d || >=cadf1d8e9ddcd74584ec961aeac14ac549b261d8 <dbcf7588e8dea017ddb3f18ec2766f7d2e5f2a0e || >=237f3faf0177bdde728fa3106d730d806436aa4d <ac7345f68cda6989016d85d63f7b244c064aa8f6 || >=4507a8b9b30344c5ddd8219945f446d47e966a6d <f6634af5de728a46792f674a66d7843570cb68f7 || >=a3f9314752dbb6f6aa1f0f2b4c58243bda800738 <1d9be95aee6c6246a21752e60c9519902649f482 || >=b04dcbb7f7b1908806b7dc22671cdbe78ff2b82c <6473ed16df1fe88051140611b3eb9a49be7f429e || >=b04dcbb7f7b1908806b7dc22671cdbe78ff2b82c <59b622a043cffc58b7638cd85ae6c30a0904f8e6 || >=b04dcbb7f7b1908806b7dc22671cdbe78ff2b82c <80bb50e2d459213cccff3111d5ef98ed4238c0d5 || 3993edf44d3df7b6e8c753eac6ac8783473fcbab || ebad462eec93b0f701dfe4de98990e7355283801 || dd0de8cb708951cebf727aa045e8242ba651bb52 || >=5.10.231 <5.10.258 || >=5.15.174 <5.15.209 || >=6.1.120 <6.1.175 || >=6.6.64 <6.6.136 || >=6.12.2 <6.12.84 || >=4.19.325 <4.20 || >=5.4.287 <5.5 || >=6.11.11 <6.12 | 493b3a682ededc804555755f5d2193201339612d, dbcf7588e8dea017ddb3f18ec2766f7d2e5f2a0e, ac7345f68cda6989016d85d63f7b244c064aa8f6, f6634af5de728a46792f674a66d7843570cb68f7, 1d9be95aee6c6246a21752e60c9519902649f482, 6473ed16df1fe88051140611b3eb9a49be7f429e, 59b622a043cffc58b7638cd85ae6c30a0904f8e6, 80bb50e2d459213cccff3111d5ef98ed4238c0d5, 5.10.258, 5.15.209, 6.1.175, 6.6.136, 6.12.84, 4.20, 5.5, 6.12 |
| Linux/Linuxgeneric | 6.13 | Not reported |
Published upstream
May 1, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 6, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 6, 2026
In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: take a reference on the USB device in create_card() The caiaq driver stores a pointer to the parent USB device in cdev->chip.dev but never takes a reference on it. The card's private_free callback, snd_usb_caiaq_card_free(), can run asynchronously via snd_card_free_when_closed() after the USB device has already been disconnected and freed, so any access to cdev->chip.dev in that path dereferences a freed usb_device. On top of the refcounting issue, the current card_free implementation calls usb_reset_device(cdev->chip.dev). A reset in a free callback is inappropriate: the device is going away, the call takes the device lock in a teardown context, and the reset races with the disconnect path that the callback is already cleaning up after. Take a reference on the USB device in create_card() with usb_get_dev(), drop it with usb_put_dev() in the free callback, and remove the usb_reset_device() call.
Quoted source text, attributed separately from HOL analysis.