Heimdall Security Logo

CVE-2026-31701

Vulnérabilité non évaluée dans Linux (Linux)

CVSS 0.0 · Non évaluée
EPSS 0.2%
Linux•Linux•Versions : 6.13, 7.0.2, cadf1d8e9ddcd74584ec961aeac14ac549b261d8, <=6.1.*, <=7.0.*, <=6.12.*, 4.19.325, 0, <6.13, 6.1.120, 5.10.231, <f6634af5de728a46792f674a66d7843570cb68f7, <59b622a043cffc58b7638cd85ae6c30a0904f8e6, 5.15.174, <6.6.136, <dbcf7588e8dea017ddb3f18ec2766f7d2e5f2a0e, 6.6.64, 6.12.2, 6.18.25, ebad462eec93b0f701dfe4de98990e7355283801, 5.15.209, <4.20, <493b3a682ededc804555755f5d2193201339612d, <=5.10.*, <=6.6.*, 6.1.175, <5.10.258, <6.12, 6.6.136, a3f9314752dbb6f6aa1f0f2b4c58243bda800738, b04dcbb7f7b1908806b7dc22671cdbe78ff2b82c, 4507a8b9b30344c5ddd8219945f446d47e966a6d, 6.12.84, <5.5, 4dd821dcbfcecf7af6a08370b0b217cde2818acf, 6.11.11, <=6.18.*, 7.1, 3993edf44d3df7b6e8c753eac6ac8783473fcbab, 5.10.258, 237f3faf0177bdde728fa3106d730d806436aa4d, <=*, <5.15.209, <6473ed16df1fe88051140611b3eb9a49be7f429e, <=5.15.*, 5.4.287, <6.1.175, <1d9be95aee6c6246a21752e60c9519902649f482, <80bb50e2d459213cccff3111d5ef98ed4238c0d5, <ac7345f68cda6989016d85d63f7b244c064aa8f6, dd0de8cb708951cebf727aa045e8242ba651bb52, <6.12.84

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: take a reference on the USB device in create_card() The caiaq driver stores a pointer to the parent USB device in cdev->chip.dev but never takes a reference on it. The card's private_free callback, snd_usb_caiaq_card_free(), can run asynchronously via snd_card_free_when_closed() after the USB device has already been disconnected and freed, so any access to cdev->chip.dev in that path dereferences a freed usb_device. On top of the refcounting issue, the current card_free implementation calls usb_reset_device(cdev->chip.dev). A reset in a free callback is inappropriate: the device is going away, the call takes the device lock in a teardown context, and the reset races with the disconnect path that the callback is already cleaning up after. Take a reference on the USB device in create_card() with usb_get_dev(), drop it with usb_put_dev() in the free callback, and remove the usb_reset_device() call.

Gravité et risque d'exploitation

CVE-2026-31701 obtient un score CVSS de 0.0/10, soit une gravité non évaluée. Selon le modèle EPSS, la probabilité qu'elle soit exploitée dans les 30 prochains jours est de 0.16 %, ce qui la place devant 5.1 % des CVE référencées.

Que faire ?

  • Vérifiez si Linux (versions 6.13, 7.0.2, cadf1d8e9ddcd74584ec961aeac14ac549b261d8, <=6.1.*, <=7.0.*, <=6.12.*, 4.19.325, 0, <6.13, 6.1.120, 5.10.231, <f6634af5de728a46792f674a66d7843570cb68f7, <59b622a043cffc58b7638cd85ae6c30a0904f8e6, 5.15.174, <6.6.136, <dbcf7588e8dea017ddb3f18ec2766f7d2e5f2a0e, 6.6.64, 6.12.2, 6.18.25, ebad462eec93b0f701dfe4de98990e7355283801, 5.15.209, <4.20, <493b3a682ededc804555755f5d2193201339612d, <=5.10.*, <=6.6.*, 6.1.175, <5.10.258, <6.12, 6.6.136, a3f9314752dbb6f6aa1f0f2b4c58243bda800738, b04dcbb7f7b1908806b7dc22671cdbe78ff2b82c, 4507a8b9b30344c5ddd8219945f446d47e966a6d, 6.12.84, <5.5, 4dd821dcbfcecf7af6a08370b0b217cde2818acf, 6.11.11, <=6.18.*, 7.1, 3993edf44d3df7b6e8c753eac6ac8783473fcbab, 5.10.258, 237f3faf0177bdde728fa3106d730d806436aa4d, <=*, <5.15.209, <6473ed16df1fe88051140611b3eb9a49be7f429e, <=5.15.*, 5.4.287, <6.1.175, <1d9be95aee6c6246a21752e60c9519902649f482, <80bb50e2d459213cccff3111d5ef98ed4238c0d5, <ac7345f68cda6989016d85d63f7b244c064aa8f6, dd0de8cb708951cebf727aa045e8242ba651bb52, <6.12.84) est présent sur votre parc.
  • Appliquez le correctif ou la version corrigée indiqués dans les références de l'éditeur.
  • À défaut de correctif, limitez l'exposition (filtrage réseau, désactivation du composant).
  • Automatisez la détection : les agents CVE Heimdall (gratuits, open source) corrèlent l'inventaire de vos serveurs avec la base CVE.

Références

Rechercher une autre CVE