CVE-2026-98066
Description
A flaw was found in the Linux kernel's ALSA (Advanced Linux Sound Architecture) caiaq USB audio driver. A local user could exploit this vulnerability to cause a Denial of Service (DoS) or memory corruption by triggering an initialization failure. The issue stems from improper resource management in the driver's error-handling path, which allows previously released memory buffers to be freed a second time.
Statement
This vulnerability is rated as Moderate severity for Red Hat Enterprise Linux because successful exploitation requires local access and the physical attachment or emulation of specialized Native Instruments USB audio hardware. In enterprise server and cloud deployments, audio subsystem hardware is rarely attached, significantly limiting the exposure of this driver. An attacker capable of presenting a crafted USB device or inducing an initialization failure could cause a denial of service or compromise kernel memory integrity.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | High | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | High | N/A | N/A |
| Integrity Impact | High | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
