CVE-2026-89895media: cobalt: Avoid freeing ALSA private data twice
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: media: cobalt: Avoid freeing ALSA private data twice snd_cobalt_card_create() stores cobsc in sc->private_data and installs snd_cobalt_card_private_free() as sc->private_free. From that point, snd_card_free(sc) releases cobsc through the ALSA card cleanup path. If cobalt_alsa_init() fails after snd_cobalt_card_create(), the err_exit_free path calls snd_card_free(sc) and then kfree(cobsc). That second free releases the same object again. Remove the explicit kfree(cobsc) and leave ownership with the ALSA card. This issue was found by a static analysis checker and confirmed by manual source review.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 85756a069c55e0315ac5990806899cfb607b987f builds before 75bbf45e3a954e292ae26832d2df40ca2e3ee452; from 85756a069c55e0315ac5990806899cfb607b987f before fe65028ee72a7e07e572b351891bd7a1f8917d33; 85756a069c55e0315ac5990806899cfb607b987f builds before 61dfa8ded5efc3a25d331fa9ce5cebb85531fe70; 85756a069c55e0315ac5990806899cfb607b987f builds before 42e00371f83c3fc7b99a36bf0229c74ad5d3c7d8; 85756a069c55e0315ac5990806899cfb607b987f builds before 6cbc8a73b3464ebeccc49987b7233b6b087b8504; from 85756a069c55e0315ac5990806899cfb607b987f before cb1218da234ea15fa14d90e2d049d686874d7aa3; 85756a069c55e0315ac5990806899cfb607b987f builds before 8c6610e230b9355cf7df5a338a0592c0f088c00b; 85756a069c55e0315ac5990806899cfb607b987f builds before 3a7d6b9c4cb5ac18cbd3f1c7f8c7b159c42ba0b1 | CNA record |
References
- https://git.kernel.org/stable/c/75bbf45e3a954e292ae26832d2df40ca2e3ee452
- https://git.kernel.org/stable/c/fe65028ee72a7e07e572b351891bd7a1f8917d33
- https://git.kernel.org/stable/c/61dfa8ded5efc3a25d331fa9ce5cebb85531fe70
- https://git.kernel.org/stable/c/42e00371f83c3fc7b99a36bf0229c74ad5d3c7d8
- https://git.kernel.org/stable/c/6cbc8a73b3464ebeccc49987b7233b6b087b8504
- https://git.kernel.org/stable/c/cb1218da234ea15fa14d90e2d049d686874d7aa3
- https://git.kernel.org/stable/c/8c6610e230b9355cf7df5a338a0592c0f088c00b
- https://git.kernel.org/stable/c/3a7d6b9c4cb5ac18cbd3f1c7f8c7b159c42ba0b1
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.