CVE-2026-98066

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98066", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:19:56.073Z", "datePublished": "2026-09-25T10:24:08.999Z", "dateUpdated": "2026-10-19T09:13:15.973Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:13:15.973Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: caiaq: Fix potential double-free at error path\n\nThe fix for caiaq driver's resource management to handle the errors\ntries to release the resources in a common destructor call, but as a\nsashiko review for another patch suggested, some of the audio\nresources such as URBs have been already freed, and this may lead to a\ndouble-free.\n\nFor addressing the double-free, call the common destructor function\nfrom each place, and assure that the resource pointers get cleared."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/usb/caiaq/audio.c"], "versions": [{"version": "da938aa9fc7826901921dcea225948ab21a97e45", "lessThan": "ddfff1cec52b7deec6c770ba85de4dab6221d0a2", "status": "affected", "versionType": "git"}, {"version": "09616e25f502080ba684fc7fcf959d1376ab756d", "lessThan": "da93fd9002d980bb02b729c5d5aeefeb252dd110", "status": "affected", "versionType": "git"}, {"version": "b956e48371f2ff72b76be9a829800ecec963bd45", "lessThan": "b6cd6f1664a0bc8038b9baa7e6f5fe8e4142d056", "status": "affected", "versionType": "git"}, {"version": "f537e3ad69609f6924a4db6b4a7f6561f5288bdd", "lessThan": "75b20534d7a37e091db585f8b505a3b77b7e81a8", "status": "affected", "versionType": "git"}, {"version": "6251e3e256337a30160ef59ab1580dde4d1acd28", "lessThan": "2883d65a3d9a8d9a682cdb003e6ab7fb28bb17f8", "status": "affected", "versionType": "git"}, {"version": "e59ecd4ee3a450db6cb4e4ecaa3efdd593f80056", "lessThan": "1dd715ca0568e4833ed5878f49b028b449941096", "status": "affected", "versionType": "git"}, {"version": "28abd224db4a49560b452115bca3672a20e45b2f", "lessThan": "b629ae7b3eddc6812d5af3614b8c1bd76d65fa75", "status": "affected", "versionType": "git"}, {"version": "28abd224db4a49560b452115bca3672a20e45b2f", "lessThan": "3b26ceef88c110f4d188387cffa0df78657be904", "status": "affected", "versionType": "git"}, {"version": "096dd8519cf2f768e9e14f224b627f7aaee1a9c5", "status": "affected", "versionType": "git"}, {"version": "5.10.258", "lessThan": "5.10.271", "status": "affected", "versionType": "semver"}, {"version": "5.15.209", "lessThan": "5.15.222", "status": "affected", "versionType": "semver"}, {"version": "6.1.175", "lessThan": "6.1.189", "status": "affected", "versionType": "semver"}, {"version": "6.6.140", "lessThan": "6.6.158", "status": "affected", "versionType": "semver"}, {"version": "6.12.86", "lessThan": "6.12.111", "status": "affected", "versionType": "semver"}, {"version": "6.18.27", "lessThan": "6.18.53", "status": "affected", "versionType": "semver"}, {"version": "7.0.4", "lessThan": "7.1", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/usb/caiaq/audio.c"], "versions": [{"version": "7.1", "status": "affected"}, {"version": "0", "lessThan": "7.1", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.271", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.258", "versionEndExcluding": "5.10.271"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.209", "versionEndExcluding": "5.15.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.175", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.140", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.86", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18.27", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1", "versionEndExcluding": "7.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0.4"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ddfff1cec52b7deec6c770ba85de4dab6221d0a2"}, {"url": "https://git.kernel.org/stable/c/da93fd9002d980bb02b729c5d5aeefeb252dd110"}, {"url": "https://git.kernel.org/stable/c/b6cd6f1664a0bc8038b9baa7e6f5fe8e4142d056"}, {"url": "https://git.kernel.org/stable/c/75b20534d7a37e091db585f8b505a3b77b7e81a8"}, {"url": "https://git.kernel.org/stable/c/2883d65a3d9a8d9a682cdb003e6ab7fb28bb17f8"}, {"url": "https://git.kernel.org/stable/c/1dd715ca0568e4833ed5878f49b028b449941096"}, {"url": "https://git.kernel.org/stable/c/b629ae7b3eddc6812d5af3614b8c1bd76d65fa75"}, {"url": "https://git.kernel.org/stable/c/3b26ceef88c110f4d188387cffa0df78657be904"}], "title": "ALSA: caiaq: Fix potential double-free at error path", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["sound/usb/caiaq/audio.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ddfff1cec52b7deec6c770ba85de4dab6221d0a2", "status": "affected", "version": "da938aa9fc7826901921dcea225948ab21a97e45", "versionType": "git"}, {"lessThan": "da93fd9002d980bb02b729c5d5aeefeb252dd110", "status": "affected", "version": "09616e25f502080ba684fc7fcf959d1376ab756d", "versionType": "git"}, {"lessThan": "b6cd6f1664a0bc8038b9baa7e6f5fe8e4142d056", "status": "affected", "version": "b956e48371f2ff72b76be9a829800ecec963bd45", "versionType": "git"}, {"lessThan": "75b20534d7a37e091db585f8b505a3b77b7e81a8", "status": "affected", "version": "f537e3ad69609f6924a4db6b4a7f6561f5288bdd", "versionType": "git"}, {"lessThan": "2883d65a3d9a8d9a682cdb003e6ab7fb28bb17f8", "status": "affected", "version": "6251e3e256337a30160ef59ab1580dde4d1acd28", "versionType": "git"}, {"lessThan": "1dd715ca0568e4833ed5878f49b028b449941096", "status": "affected", "version": "e59ecd4ee3a450db6cb4e4ecaa3efdd593f80056", "versionType": "git"}, {"lessThan": "b629ae7b3eddc6812d5af3614b8c1bd76d65fa75", "status": "affected", "version": "28abd224db4a49560b452115bca3672a20e45b2f", "versionType": "git"}, {"lessThan": "3b26ceef88c110f4d188387cffa0df78657be904", "status": "affected", "version": "28abd224db4a49560b452115bca3672a20e45b2f", "versionType": "git"}, {"status": "affected", "version": "096dd8519cf2f768e9e14f224b627f7aaee1a9c5", "versionType": "git"}, {"lessThan": "5.10.271", "status": "affected", "version": "5.10.258", "versionType": "semver"}, {"lessThan": "5.15.222", "status": "affected", "version": "5.15.209", "versionType": "semver"}, {"lessThan": "6.1.189", "status": "affected", "version": "6.1.175", "versionType": "semver"}, {"lessThan": "6.6.158", "status": "affected", "version": "6.6.140", "versionType": "semver"}, {"lessThan": "6.12.111", "status": "affected", "version": "6.12.86", "versionType": "semver"}, {"lessThan": "6.18.53", "status": "affected", "version": "6.18.27", "versionType": "semver"}, {"lessThan": "7.1", "status": "affected", "version": "7.0.4", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["sound/usb/caiaq/audio.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.1"}, {"lessThan": "7.1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.271", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.222", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: caiaq: Fix potential double-free at error path\n\nThe fix for caiaq driver's resource management to handle the errors\ntries to release the resources in a common destructor call, but as a\nsashiko review for another patch suggested, some of the audio\nresources such as URBs have been already freed, and this may lead to a\ndouble-free.\n\nFor addressing the double-free, call the common destructor function\nfrom each place, and assure that the resource pointers get cleared."}], "id": "CVE-2026-98066", "lastModified": "2026-10-19T10:18:01.323", "metrics": {}, "published": "2026-09-25T11:17:35.667", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1dd715ca0568e4833ed5878f49b028b449941096"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2883d65a3d9a8d9a682cdb003e6ab7fb28bb17f8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3b26ceef88c110f4d188387cffa0df78657be904"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/75b20534d7a37e091db585f8b505a3b77b7e81a8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b629ae7b3eddc6812d5af3614b8c1bd76d65fa75"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b6cd6f1664a0bc8038b9baa7e6f5fe8e4142d056"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/da93fd9002d980bb02b729c5d5aeefeb252dd110"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ddfff1cec52b7deec6c770ba85de4dab6221d0a2"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Undergoing Analysis"}

{"bugzilla": {"description": "kernel: ALSA: caiaq: Fix potential double-free at error path", "id": "2541139", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541139"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-1341", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nALSA: caiaq: Fix potential double-free at error path\nThe fix for caiaq driver's resource management to handle the errors\ntries to release the resources in a common destructor call, but as a\nsashiko review for another patch suggested, some of the audio\nresources such as URBs have been already freed, and this may lead to a\ndouble-free.\nFor addressing the double-free, call the common destructor function\nfrom each place, and assure that the resource pointers get cleared.", "A flaw was found in the Linux kernel's ALSA (Advanced Linux Sound Architecture) caiaq USB audio driver. A local user could exploit this vulnerability to cause a Denial of Service (DoS) or memory corruption by triggering an initialization failure. The issue stems from improper resource management in the driver's error-handling path, which allows previously released memory buffers to be freed a second time."], "name": "CVE-2026-98066", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98066\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98066\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98066.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6251e3e256337a30160ef59ab1580dde4d1acd28,2883d65a3d9a8d9a682cdb003e6ab7fb28bb17f8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e59ecd4ee3a450db6cb4e4ecaa3efdd593f80056,1dd715ca0568e4833ed5878f49b028b449941096)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[28abd224db4a49560b452115bca3672a20e45b2f,b629ae7b3eddc6812d5af3614b8c1bd76d65fa75)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[28abd224db4a49560b452115bca3672a20e45b2f,3b26ceef88c110f4d188387cffa0df78657be904)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "da938aa9fc7826901921dcea225948ab21a97e45"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "09616e25f502080ba684fc7fcf959d1376ab756d"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "b956e48371f2ff72b76be9a829800ecec963bd45"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "f537e3ad69609f6924a4db6b4a7f6561f5288bdd"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "096dd8519cf2f768e9e14f224b627f7aaee1a9c5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.12.86,6.12.111)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.18.27,6.18.53)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5.10.258,5.11)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5.15.209,5.16)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[6.1.175,6.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[6.6.140,6.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[7.0.4,7.1)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.1"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,7.1)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.111,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.53,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2.7,7.2.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T17:30:17.001599+00:00", "updated": "2026-09-30T06:00:12.762707+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}