Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-46048

In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: fix usb_dev refcount leak on probe failure create_card() takes a reference on the USB device with usb_get_dev() and stores the matching usb_put_dev() in card_free(), which is installed as the snd_card's ->private_free destructor. However, ->private_free is only assigned near the end of init_card(), after several failure points (usb_set_interface(), EP type checks, usb_submit_urb(), the EP1_CMD_GET_DEVICE_INFO exc
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:0c4b1c42c927203841f739c50657176c0b178e31b52e85a11a99b2f00af2e7f0
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"unaffected","product":"Linux","programFiles":["sound/usb/caiaq/device.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6.6.140","status":"affected","version":"6.6.136","versionType":"semver"},{"lessThan":"6.12.86","status":"affected","version":"6.12.84","versionType":"semver"},{"lessThan":"6.18.27","status":"affected","version":"6.18.25","versionType":"semver"},{"lessThan":"7.0.4","status":"affected","version":"7.0.2","versionType":"semver"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:357b1be3479d493c225788500b403900465787a488c0ad70c680a0448bb49bed · sha256:fc28e853144bf6db… · /containers/cna/affected/1

{"defaultStatus":"unaffected","product":"Linux","programFiles":["sound/usb/caiaq/device.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c874db8a1d2f9f08161470d00cfe8db2f5cca2cc","status":"affected","version":"493b3a682ededc804555755f5d2193201339612d","versionType":"git"},{"lessThan":"6fa8dff64fb6c401ced40a05797b327659317498","status":"affected","version":"dbcf7588e8dea017ddb3f18ec2766f7d2e5f2a0e","versionType":"git"},{"lessThan":"a8d907acc3e5a078c2e5637ff60c30c6d2ddc23a","status":"affected","version":"ac7345f68cda6989016d8…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:357b1be3479d493c225788500b403900465787a488c0ad70c680a0448bb49bed · sha256:fc28e853144bf6db… · /containers/cna/affected/0

Affected products and versions

2 source assertions
{"defaultStatus":"unaffected","product":"Linux","programFiles":["sound/usb/caiaq/device.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6.6.140","status":"affected","version":"6.6.136","versionType":"semver"},{"lessThan":"6.12.86","status":"affected","version":"6.12.84","versionType":"semver"},{"lessThan":"6.18.27","status":"affected","version":"6.18.25","versionType":"semver"},{"lessThan":"7.0.4","status":"affected","version":"7.0.2","versionType":"semver"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:357b1be3479d493c225788500b403900465787a488c0ad70c680a0448bb49bed · sha256:fc28e853144bf6db… · /containers/cna/affected/1
{"defaultStatus":"unaffected","product":"Linux","programFiles":["sound/usb/caiaq/device.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c874db8a1d2f9f08161470d00cfe8db2f5cca2cc","status":"affected","version":"493b3a682ededc804555755f5d2193201339612d","versionType":"git"},{"lessThan":"6fa8dff64fb6c401ced40a05797b327659317498","status":"affected","version":"dbcf7588e8dea017ddb3f18ec2766f7d2e5f2a0e","versionType":"git"},{"lessThan":"a8d907acc3e5a078c2e5637ff60c30c6d2ddc23a","status":"affected","version":"ac7345f68cda6989016d8…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:357b1be3479d493c225788500b403900465787a488c0ad70c680a0448bb49bed · sha256:fc28e853144bf6db… · /containers/cna/affected/0

Source references

8 source assertions
{"url":"https://git.kernel.org/stable/c/21ca595aafa40d3ac70eab1f4cb62cc00ca21657"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:357b1be3479d493c225788500b403900465787a488c0ad70c680a0448bb49bed · sha256:fc28e853144bf6db… · /containers/cna/references/6
{"url":"https://git.kernel.org/stable/c/50c6a1f05973f56d23280c9d7645a7a5734e0907"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:357b1be3479d493c225788500b403900465787a488c0ad70c680a0448bb49bed · sha256:fc28e853144bf6db… · /containers/cna/references/3
{"url":"https://git.kernel.org/stable/c/6153878c5255bb69b7d0868105ca078ef13cbcf8"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:357b1be3479d493c225788500b403900465787a488c0ad70c680a0448bb49bed · sha256:fc28e853144bf6db… · /containers/cna/references/5
{"url":"https://git.kernel.org/stable/c/6fa8dff64fb6c401ced40a05797b327659317498"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:357b1be3479d493c225788500b403900465787a488c0ad70c680a0448bb49bed · sha256:fc28e853144bf6db… · /containers/cna/references/1
{"url":"https://git.kernel.org/stable/c/7a5f1cd22d47f8ca4b760b6334378ae42c1bd24b"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:357b1be3479d493c225788500b403900465787a488c0ad70c680a0448bb49bed · sha256:fc28e853144bf6db… · /containers/cna/references/7
{"url":"https://git.kernel.org/stable/c/a8d907acc3e5a078c2e5637ff60c30c6d2ddc23a"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:357b1be3479d493c225788500b403900465787a488c0ad70c680a0448bb49bed · sha256:fc28e853144bf6db… · /containers/cna/references/2
{"url":"https://git.kernel.org/stable/c/c874db8a1d2f9f08161470d00cfe8db2f5cca2cc"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:357b1be3479d493c225788500b403900465787a488c0ad70c680a0448bb49bed · sha256:fc28e853144bf6db… · /containers/cna/references/0
{"url":"https://git.kernel.org/stable/c/da3b8fd6a202d94fef11a443abc9171c52426a1c"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:357b1be3479d493c225788500b403900465787a488c0ad70c680a0448bb49bed · sha256:fc28e853144bf6db… · /containers/cna/references/4

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer