PT-2026-43915 · Linux · Linux Kernel
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 7.0.11-1.1
Description
A reference count leak occurs in the ALSA caiaq component of the Linux kernel during probe failure. The
create card() function increases the reference count of the USB device using usb get dev(), but the corresponding usb put dev() is only executed via the card free() destructor. Because the ->private free destructor is assigned late in the init card() process, any failure occurring before this assignment—such as errors in usb set interface(), endpoint type checks, usb submit urb(), or the EP1 CMD GET DEVICE INFO exchange—prevents card free() from running. This results in a leak of the struct usb device, its descriptor allocations, and device private data.Recommendations
Update to version 7.0.11-1.1 or newer.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux Kernel