---
id: CVE-2026-31778
title: 'ALSA: caiaq: fix stack out-of-bounds read in init_card'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ALSA: caiaq: fix stack out-of-bounds read in init_card

  The loop creates a whitespace-stripped copy of the card shortname
  where `len < sizeof(card->id)` is used for the…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a <
    02d9c5b0b5553a391448b6d655262bd829f90234
  - >-
    Linux >= bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a <
    3f7f8bae0d52cbd07ab04b76b6aac89ef98ee9f6
  - >-
    Linux >= bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a <
    66194c2575a4f567577ae70b1d7561163ce791a6
  - >-
    Linux >= bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a <
    a82c1bce2d1299dd3c686a8fe48cf75b79a403c7
  - >-
    Linux >= bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a <
    3178b62e2e31bab39f63d4c8e54bf4ee0a425627
  - >-
    Linux >= bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a <
    3afa2e67f3523a980a2f90fd63c22322ac2b9ce0
  - >-
    Linux >= bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a <
    7594a6464873d90fd229e5b94cdd3b92c9feabed
  - >-
    Linux >= bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a <
    45424e871abf2a152e247a9cff78359f18dd95c0
  - Linux 2.6.31
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T15:25:25.500479Z'
published: '2026-05-01'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T15:32:25.311Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-31778'
references:
  - url: 'https://git.kernel.org/stable/c/02d9c5b0b5553a391448b6d655262bd829f90234'
  - url: 'https://git.kernel.org/stable/c/3f7f8bae0d52cbd07ab04b76b6aac89ef98ee9f6'
  - url: 'https://git.kernel.org/stable/c/66194c2575a4f567577ae70b1d7561163ce791a6'
  - url: 'https://git.kernel.org/stable/c/a82c1bce2d1299dd3c686a8fe48cf75b79a403c7'
  - url: 'https://git.kernel.org/stable/c/3178b62e2e31bab39f63d4c8e54bf4ee0a425627'
  - url: 'https://git.kernel.org/stable/c/3afa2e67f3523a980a2f90fd63c22322ac2b9ce0'
  - url: 'https://git.kernel.org/stable/c/7594a6464873d90fd229e5b94cdd3b92c9feabed'
  - url: 'https://git.kernel.org/stable/c/45424e871abf2a152e247a9cff78359f18dd95c0'
tags:
  - cve.org
epss: 0.00126
epssPercentile: 0.02284
ingestedAt: '2026-11-06T15:54:04.040Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ALSA: caiaq: fix stack out-of-bounds read in init_card

The loop creates a whitespace-stripped copy of the card shortname
where `len < sizeof(card->id)` is used for the bounds check. Since
sizeof(card->id) is 16 and the local id buffer is also 16 bytes,
writing 16 non-space characters fills the entire buffer,
overwriting the terminating nullbyte.

When this non-null-terminated string is later passed to
snd_card_set_id() -> copy_valid_id_string(), the function scans
forward with `while (*nid && ...)` and reads past the end of the
stack buffer, reading the contents of the stack.

A USB device with a product name containing many non-ASCII, non-space
characters (e.g. multibyte UTF-8) will reliably trigger this as follows:

  BUG: KASAN: stack-out-of-bounds in copy_valid_id_string
       sound/core/init.c:696 [inline]
  BUG: KASAN: stack-out-of-bounds in snd_card_set_id_no_lock+0x698/0x74c
       sound/core/init.c:718

The off-by-one has been present since commit bafeee5b1f8d ("ALSA:
snd_usb_caiaq: give better shortname") from June 2009 (v2.6.31-rc1),
which first introduced this whitespace-stripping loop. The original
code never accounted for the null terminator when bounding the copy.

Fix this by changing the loop bound to `sizeof(card->id) - 1`,
ensuring at least one byte remains as the null terminator.

## Affected

- `Linux >= bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a < 02d9c5b0b5553a391448b6d655262bd829f90234`
- `Linux >= bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a < 3f7f8bae0d52cbd07ab04b76b6aac89ef98ee9f6`
- `Linux >= bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a < 66194c2575a4f567577ae70b1d7561163ce791a6`
- `Linux >= bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a < a82c1bce2d1299dd3c686a8fe48cf75b79a403c7`
- `Linux >= bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a < 3178b62e2e31bab39f63d4c8e54bf4ee0a425627`
- `Linux >= bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a < 3afa2e67f3523a980a2f90fd63c22322ac2b9ce0`
- `Linux >= bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a < 7594a6464873d90fd229e5b94cdd3b92c9feabed`
- `Linux >= bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a < 45424e871abf2a152e247a9cff78359f18dd95c0`
- `Linux 2.6.31`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.