CVE-2026-98086

In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: do not touch legacyrmidi before it exists sndumpparseendpoint sets ump-parsed on every exit, including error, before the caller attaches the legacy rawmidi device. umphandleepnamemsg then treats parsed as "legacyrmidi ...

EUVD-2026-86916

In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: do not touch legacyrmidi before it exists sndumpparseendpoint sets ump-parsed on every exit, including error, before the caller attaches the legacy rawmidi device. umphandleepnamemsg then treats parsed as "legacyrmidi ...

CVE-2026-98086

The Linux kernel contains a vulnerability in the ALSA subsystem related to the UMP component. The function snd_ump_parse_endpoint() incorrectly sets ump->parsed on every exit, including errors, before the legacy rawmidi device is attached. Consequently, ump_handle_ep_name_msg() may treat parse...

CVE-2026-98086 ALSA: ump: do not touch legacy_rmidi before it exists

In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: do not touch legacyrmidi before it exists sndumpparseendpoint sets ump-parsed on every exit, including error, before the caller attaches the legacy rawmidi device. umphandleepnamemsg then treats parsed as "legacyrmidi ...

CVE-2026-98066 ALSA: caiaq: Fix potential double-free at error path

In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: Fix potential double-free at error path The fix for caiaq driver's resource management to handle the errors tries to release the resources in a common destructor call, but as a sashiko review for another patch...

EUVD-2026-86719

In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: Fix potential double-free at error path The fix for caiaq driver's resource management to handle the errors tries to release the resources in a common destructor call, but as a sashiko review for another patch...

CVE-2026-98066

In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: Fix potential double-free at error path The fix for caiaq driver's resource management to handle the errors tries to release the resources in a common destructor call, but as a sashiko review for another patch...

CVE-2026-98066

The Linux kernel 's caiaq audio driver contains a vulnerability where the resource management logic for handling errors can result in a double-free condition. Specifically, certain audio resources, such as URBs , may have been previously freed, yet the driver attempts to release them again during...

CVE-2026-98066 ALSA: caiaq: Fix potential double-free at error path

In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: Fix potential double-free at error path The fix for caiaq driver's resource management to handle the errors tries to release the resources in a common destructor call, but as a sashiko review for another patch...

CVE-2026-98006

In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: Decoupling ep1inurb in caiaq dev The epqinurb object belonging to the caiaq device is coupled within the struct sndusbcaiaqdev. After usbsubmiturbepqinurb, GFPKERNEL executes successfully, epqinurb is successfully...

CVE-2026-98006 ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev

In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: Decoupling ep1inurb in caiaq dev The epqinurb object belonging to the caiaq device is coupled within the struct sndusbcaiaqdev. After usbsubmiturbepqinurb, GFPKERNEL executes successfully, epqinurb is successfully...

EUVD-2026-86659

In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: Decoupling ep1inurb in caiaq dev The epqinurb object belonging to the caiaq device is coupled within the struct sndusbcaiaqdev. After usbsubmiturbepqinurb, GFPKERNEL executes successfully, epqinurb is successfully...

CVE-2026-98006

The Linux kernel contains a use-after-free vulnerability in the ALSA caiaq USB device driver. The issue arises because the ep1_in_urb (and midi_out_urb) objects are embedded within the snd_usb_caiaqdev structure. When a command fails due to a timeout and snd_card_free() is called to release the c...

CVE-2026-98006 ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev

In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: Decoupling ep1inurb in caiaq dev The epqinurb object belonging to the caiaq device is coupled within the struct sndusbcaiaqdev. After usbsubmiturbepqinurb, GFPKERNEL executes successfully, epqinurb is successfully...

EUVD-2026-86785

In the Linux kernel, the following vulnerability has been resolved: ALSA: us122l: Prevent write upgrades for read mappings The hwdep mmap callback rejects read-buffer mappings that are initially writable, but leaves VMMAYWRITE set on mappings created with PROTREAD. A process that can open the hwd...

CVE-2026-97931

In the Linux kernel, the following vulnerability has been resolved: ALSA: us122l: Prevent write upgrades for read mappings The hwdep mmap callback rejects read-buffer mappings that are initially writable, but leaves VMMAYWRITE set on mappings created with PROTREAD. A process that can open the hwd...

CVE-2026-97931 ALSA: us122l: Prevent write upgrades for read mappings

In the Linux kernel, the following vulnerability has been resolved: ALSA: us122l: Prevent write upgrades for read mappings The hwdep mmap callback rejects read-buffer mappings that are initially writable, but leaves VMMAYWRITE set on mappings created with PROTREAD. A process that can open the hwd...

CVE-2026-97931 ALSA: us122l: Prevent write upgrades for read mappings

In the Linux kernel, the following vulnerability has been resolved: ALSA: us122l: Prevent write upgrades for read mappings The hwdep mmap callback rejects read-buffer mappings that are initially writable, but leaves VMMAYWRITE set on mappings created with PROTREAD. A process that can open the hwd...

CVE-2026-97931

The Linux kernel contains a vulnerability in the ALSA subsystem where the hwdep mmap callback fails to clear the VM_MAYWRITE flag on read-buffer mappings created with PROT_READ . This allows a process capable of opening the hwdep node with O_RDWR to use mprotect() to escalate permissions and make...

CVE-2026-97930

In the Linux kernel, the following vulnerability has been resolved: ALSA: usbusx2y: fix in04last array size mismatch with in04buf The in04last array in struct usx2ydev is declared as char24, but in04buf is allocated as sizeofstruct us428ctls which is 21 bytes. In iusx2yin04int, when ctlsnapshotla...