CVE-2026-89895

Not scored yetLast modified Oct 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

media: cobalt: Avoid freeing ALSA private data twice

snd_cobalt_card_create() stores cobsc in sc->private_data and installs snd_cobalt_card_private_free() as sc->private_free. From that point, snd_card_free(sc) releases cobsc through the ALSA card cleanup path.

If cobalt_alsa_init() fails after snd_cobalt_card_create(), the err_exit_free path calls snd_card_free(sc) and then kfree(cobsc). That second free releases the same object again.

Remove the explicit kfree(cobsc) and leave ownership with the ALSA card.

This issue was found by a static analysis checker and confirmed by manual source review.

Metrics

No CVSS score has been published yet.

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 85756a069c55e0315ac5990806899cfb607b987f, < 75bbf45e3a954e292ae26832d2df40ca2e3ee452; >= 85756a069c55e0315ac5990806899cfb607b987f, < fe65028ee72a7e07e572b351891bd7a1f8917d33; >= 85756a069c55e0315ac5990806899cfb607b987f, < 61dfa8ded5efc3a25d331fa9ce5cebb85531fe70; >= 85756a069c55e0315ac5990806899cfb607b987f, < 42e00371f83c3fc7b99a36bf0229c74ad5d3c7d8; >= 85756a069c55e0315ac5990806899cfb607b987f, < 6cbc8a73b3464ebeccc49987b7233b6b087b8504; >= 85756a069c55e0315ac5990806899cfb607b987f, < cb1218da234ea15fa14d90e2d049d686874d7aa3; >= 85756a069c55e0315ac5990806899cfb607b987f, < 8c6610e230b9355cf7df5a338a0592c0f088c00b; >= 85756a069c55e0315ac5990806899cfb607b987f, < 3a7d6b9c4cb5ac18cbd3f1c7f8c7b159c42ba0b1
LinuxLinux4.2

References

Timeline

Published
Sep 16, 2026
Last modified
Oct 19, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-89896In the Linux kernel, the following vulnerability has been resolved: media: cedrus: fix memory leak in cedrus_init_ctrls() In cedrus_init_cCVE-2026-898977.5In the Linux kernel, the following vulnerability has been resolved: media: cec: Serialize exclusive follower delivery cec_receive_notify()CVE-2026-898988.8In the Linux kernel, the following vulnerability has been resolved: media: cec: extron-da-hd-4k-plus: add sanity check Add check to prevenCVE-2026-898997.8In the Linux kernel, the following vulnerability has been resolved: media: cec: disable delayed work before freeing an interrupted transmitCVE-2026-89905.3A user with physical access to a smartphone can bypass authentication mechanism of Kidsview mobile application and grant himself full accessCVE-2026-89900In the Linux kernel, the following vulnerability has been resolved: media: cec: core: Fix kmemleak due to missed rc_free_device() call TheCVE-2026-89901In the Linux kernel, the following vulnerability has been resolved: media: airspy: use vb2_video_unregister_device() on disconnect to fix NCVE-2026-899027.8In the Linux kernel, the following vulnerability has been resolved: LoongArch: Avoid preempt count underflow without probe LoongArch uses CVE-2026-899037.8In the Linux kernel, the following vulnerability has been resolved: LoongArch: Do not save/restore percpu base register in rethook trampoliCVE-2026-899048.4In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix acpi_package_ids[] array overflow With LoongArch virt mCVE-2026-89905In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Move arena register slot below TCC context Currently, CVE-2026-899067.8In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Refactor jump offset calculation in tail call The old
CVE-2026-89895: Unscored | Vulnix