CVE-2026-90119ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup snd_ice1712_probe() performs multiple initialization steps after snd_card_new(), but directly returns on failures from later steps without releasing the ALSA card, causing resource leaks when probing fails. Use snd_devm_card_new() together with scope-based cleanup via __free(snd_card_unref), and clear the card pointer after successful registration to keep it alive.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from ca642da4b33d385c5a633287e1c4155f1ea09638 before c5c7c7b6cfae73c46e4544a9ef08ff89231a670d; from ca642da4b33d385c5a633287e1c4155f1ea09638 before d8ac49391a1562dc784fc91e810e696284cb647e; from ca642da4b33d385c5a633287e1c4155f1ea09638 before b15782627b6562f7b6d628f4699316f26340f835; from ca642da4b33d385c5a633287e1c4155f1ea09638 before 24b399f51812d727dc25d7814c4d7e0cca38201e; from ca642da4b33d385c5a633287e1c4155f1ea09638 before d736eba9c453fedce664fdf592c8b71ecff1932b | CNA record |
References
- https://git.kernel.org/stable/c/c5c7c7b6cfae73c46e4544a9ef08ff89231a670d
- https://git.kernel.org/stable/c/d8ac49391a1562dc784fc91e810e696284cb647e
- https://git.kernel.org/stable/c/b15782627b6562f7b6d628f4699316f26340f835
- https://git.kernel.org/stable/c/24b399f51812d727dc25d7814c4d7e0cca38201e
- https://git.kernel.org/stable/c/d736eba9c453fedce664fdf592c8b71ecff1932b
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.