CVE-2026-98066: ALSA: caiaq: Fix potential double-free at error path

Severity: unknown
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-25 · updated 2026-10-19

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: Fix potential double-free at error path The fix for caiaq driver's resource management to handle the errors tries to release the resources in a common destructor call, but as a sashiko review for another patch suggested, some of the audio resources such as URBs have been already freed, and this may lead to a double-free. For addressing the double-free, call the common destructor function from each place, and assure that the resource pointers get cleared.

Affected products

Linux kernel: from 5.10.258 before 5.10.271; from 5.15.209 before 5.15.222; from 6.1.175 before 6.1.189; from 6.6.140 before 6.6.158; from 6.12.86 before 6.12.111; from 6.18.27 before 6.18.53 — fixed in 5.10.271, 5.15.222, 6.1.189, 6.12.111, 6.18.53, 6.6.158

How to fix

Upgrade to a fixed version: Linux kernel 5.10.271, 5.15.222, 6.1.189, 6.12.111. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-98066 or the next vulnerability affects your stack