CVE-2026-31778 is a high-severity vulnerability in the Linux kernel ALSA subsystem affecting the caiaq USB audio driver. It involves a stack out-of-bounds read caused by an off-by-one error in a whitespace-stripping loop that copies the card shortname without properly reserving space for the null terminator. This flaw can lead to reading beyond the stack buffer when processing USB device product names with many non-ASCII characters. The issue has existed since 2009 and was fixed by adjusting the loop bound to ensure null termination.