Is there a patch available for CVE-2026-98837?

Yes, a patch is available for CVE-2026-98837. Update the affected software to the latest version immediately.

Linux CVE-2026-98837

EUVD-2026-103777

2026-10-18 Linux

GHSA-gvp5-mg7r-w29g

Information Disclosure Linux

View

Monitor Track and reassess. Why: No CVSS yet + weak signal (CWE or non-zero EPSS).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ALSA: caiaq: unregister the input device when probe fails

setup_card() registers the input device, whose name and phys point into struct snd_usb_caiaqdev, and then goes on to snd_card_register() and snd_usb_caiaq_control_init(). If either fails, snd_probe() calls snd_card_free(), which frees the device state but leaves the input device registered: card_free() only clears the pointer, and the input device is unregistered from snd_disconnect() alone. Reading its "uevent" attribute afterwards dereferences freed memory:

BUG: KASAN: slab-use-after-free in string+0x4a9/0x4f0 Read of size 1 at addr ffff8880208f5043 by task caiaq/4967 add_uevent_var+0x183/0x3a0 input_dev_uevent+0x162/0x900 dev_uevent+0x2f1/0x870 uevent_show+0x1ca/0x3a0 ...

Unregister the input device on the probe error path, as snd_disconnect() does. snd_usb_caiaq_input_disconnect() is a no-op when no input device was registered.

Reproduced with a raw-gadget Audio Kontrol 1 and a temporary hack that makes snd_usb_caiaq_control_init() fail.

Affected VersionsENISA

Linux 7.1

Linux 5.15.209 <5.16

Linux e59ecd4ee3a450db6cb4e4ecaa3efdd593f80056 <84727facd8506140cd04f2b0a8b1c4ddeac41cea

Linux f537e3ad69609f6924a4db6b4a7f6561f5288bdd

Linux 28abd224db4a49560b452115bca3672a20e45b2f <2e5a413cc2a489c9427ecd3d73ad764bfb0c7103

Linux patch: 7.3-rc6

Linux 5.10.258 <5.11

Linux patch: 6.12.113

Linux patch: 0

Linux patch: 6.18.56

Linux da938aa9fc7826901921dcea225948ab21a97e45

Linux 6.18.27 <6.18.56

Linux 7.0.4 <7.1

Linux 6.6.140 <6.7

Linux 28abd224db4a49560b452115bca3672a20e45b2f <0b7bd20f6379bc5e431fd74d866390f5b5b63f3c

Linux 6.12.86 <6.12.113

Linux patch: 7.2.10

Linux 096dd8519cf2f768e9e14f224b627f7aaee1a9c5

Linux 6251e3e256337a30160ef59ab1580dde4d1acd28 <850810c12686f80cdf7530f4f21e0157d904f739

Linux b956e48371f2ff72b76be9a829800ecec963bd45

Linux 6.1.175 <6.2

Linux 09616e25f502080ba684fc7fcf959d1376ab756d

Affected Packages

euvd linux fix: 5.11, 5.16, 6.2, 6.7, 6.12.113, 6.18.56, 7.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Lifecycle Timeline

Patch available

Oct 18, 2026 - 17:19 EUVD

CVE Published

Oct 18, 2026 - 15:50 cve.org

UNKNOWN (no severity yet)

Threat Intelligence Overview

EPSS Score

0.2%

Top 91% exploitable

Data Quality

3 sources

Confidence: Low

EUVD

CVE.org

EPSS MSRC

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity Not scored yet

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

No CVSS yet + weak signal (CWE or non-zero EPSS)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.