In the Linux kernel, the following vulnerability has been resolved:
ALSA: caiaq: take a reference on the USB device in create_card()
The caiaq driver stores a pointer to the parent USB device in cdev->chip.dev but never takes a reference on it. The card's privatefree callback, sndusbcaiaqcardfree(), can run asynchronously via sndcardfreewhenclosed() after the USB device has already been disconnected and freed, so any access to cdev->chip.dev in that path dereferences a freed usbdevice.
On top of the refcounting issue, the current cardfree implementation calls usbreset_device(cdev->chip.dev). A reset in a free callback is inappropriate: the device is going away, the call takes the device lock in a teardown context, and the reset races with the disconnect path that the callback is already cleaning up after.
Take a reference on the USB device in createcard() with usbgetdev(), drop it with usbputdev() in the free callback, and remove the usbreset_device() call.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31701.json",
"cna_assigner": "Linux"
}