Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - Linux カーネルでは、以下の脆弱性が解決されています: ALSA: caiaq: fix usb_dev refcount leak on probe failure create_card() takes a reference on the USB device with usb_get_dev() and stores the matching usb_put_dev() in card_free(), which is installed as the snd_card's ->private_free destructor.
    However, ->private_free is only assigned near the end of init_card(), after several failure points (usb_set_interface(), EP type checks, usb_submit_urb(), the EP1_CMD_GET_DEVICE_INFO exchange, and its timeout). When any of those fail, init_card() returns an error to snd_probe(), which calls snd_card_free(card). Because ->private_free is still NULL, card_free() never runs, the usb_get_dev() reference is not dropped, and the struct usb_device leaks along with its descriptor allocations and device_private. syzbot reproduces this with a malformed UAC3 device whose only valid altsetting is 0;
    init_card()'s usb_set_interface(usb_dev, 0, 1) call fails with -EIO and triggers the leak. Move the
    ->private_free assignment into create_card(), immediately after usb_get_dev(), so that every error path reaching snd_card_free() balances the reference. card_free()'s callees (snd_usb_caiaq_input_free, free_urbs, kfree) already tolerate the partially-initialized state because the chip private area is zero-initialized by snd_card_new(). (CVE-2026-46048)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

検出

Linux Distros のパッチ未適用の脆弱性: CVE-2026-46048

medium Nessus プラグイン ID 318462

バージョン 1.4

バージョン 1.3

バージョン 1.2

バージョン 1.1

バージョン 1.4 Jun 25, 2026, 9:10 AM CVSS metrics ("CVSSv2 score" set to 4.6) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C") CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:U/RL:U/RC:C") CVSSv2 severity (based on CVE-2026-46048, severity decreased from "High" to "Medium") CVSSv3 score source (changed from "CVE-2026-46048" to none) Plugin Feed: 202606250910
バージョン 1.3 Jun 24, 2026, 7:46 AM CVSS metrics ("CVSSv2 score" set to none) CVSS metrics ("CVSSv2 vector" set to none) CVSS temporal metrics ("CVSSv2 temporal vector" set to none) CVSSv2 severity (based on CVE-2026-46048, severity increased from "Medium" to "High") CVSSv3 score source (set to "CVE-2026-46048") Detection (updated detection logic) Plugin metadata Plugin Feed: 202606240746
バージョン 1.2 Jun 17, 2026, 9:10 AM CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C") CVSS metrics ("CVSSv2 score" set to 4.6) Plugin Feed: 202606170910
バージョン 1.1 Jun 4, 2026, 6:01 AM New Plugin Feed: 202606040601