CVE-2026-98006

A moderate severity use-after-free flaw was found in the Linux kernel's ALSA caiaq USB audio driver (sound/usb/caiaq) as shipped in Red Hat products. When caiaq device initialization fails, for example when a control command times out, the driver calls snd_card_free() and releases the card object while the embedded ep1_in_urb and midi_out_urb USB request blocks (URBs) may still be queued in the host controller driver. A later asynchronous URB giveback then calls usb_free_urb() on the already-freed memory, producing a kernel slab use-after-free write. An attacker able to connect a crafted USB device, or a local user who can attach a malicious device (for example in a dummy HCD/USB gadget setup), could exploit this race during device probing to crash the kernel and cause a denial of service. Although arbitrary code execution cannot be ruled out for a use-after-free write in kernel memory, the demonstrated impact is denial of service, which is reflected in the moderate severity rating (CVSS 3.1 score 5.5 with availability-only impact). Red Hat Enterprise Linux 7, 8, 9, and 10 (kernel and kernel-rt), Red Hat In-Vehicle OS 2, and OpenShift Container Platform releases shipping RHEL CoreOS are affected; the fix is currently deferred for these streams because the flaw is of moderate severity and exploitation requires local or physical access and winning a narrow timing window during a failed device initialization, so the residual risk is that the use-after-free remains present until a fix is delivered in a future update. Red Hat Enterprise Linux 6 Extended Lifecycle Support is out of support, so no fix is planned for that stream.