CVE-2026-89895 in Linux
Summary
by MITRE • 09/16/2026
In the Linux kernel, the following vulnerability has been resolved:
media: cobalt: Avoid freeing ALSA private data twice
snd_cobalt_card_create() stores cobsc in sc->private_data and installs snd_cobalt_card_private_free() as sc->private_free. From that point, snd_card_free(sc) releases cobsc through the ALSA card cleanup path.
If cobalt_alsa_init() fails after snd_cobalt_card_create(), the err_exit_free path calls snd_card_free(sc) and then kfree(cobsc). That second free releases the same object again.
Remove the explicit kfree(cobsc) and leave ownership with the ALSA card.
This issue was found by a static analysis checker and confirmed by manual source review.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The Linux kernel media subsystem contains a critical memory management flaw within the Cobalt audio driver, specifically involving improper handling of private data structures during initialization failure paths. The vulnerability arises from an incorrect assumption regarding object ownership and lifecycle management between the ALSA core framework and the specific device driver implementation. When the snd_cobalt_card_create function is invoked to initialize the sound card, it allocates a structure referred to as cobsc and assigns this pointer to sc->private_data while simultaneously registering snd_cobalt_card_private_free as the callback for sc->private_free. This configuration establishes that the ALSA core framework assumes full ownership of the allocated memory block and will automatically invoke the designated cleanup function when the sound card is released via snd_card_free.
The operational impact manifests during error handling sequences within cobalt_alsa_init. If this initialization routine encounters a failure after snd_cobalt_card_create has successfully executed, control flow diverts to an err_exit_free path designed to clean up resources before returning an error code. In the flawed implementation, this cleanup sequence explicitly calls snd_card_free(sc) followed immediately by kfree(cobsc). Because snd_card_free triggers the ALSA card cleanup mechanism which in turn invokes sc->private_free (i.e., snd_cobalt_card_private_free), the cobsc structure is already deallocated during that call. The subsequent explicit invocation of kfree on the same pointer results in a double-free condition, where memory previously returned to the kernel allocator is freed again.
This type of vulnerability falls under CWE-415 Double Free, which occurs when an application frees memory twice without resetting the pointer or verifying its allocation status between calls. In the context of Linux kernel development, such errors can lead to severe stability issues including kernel panics, data corruption within slab caches, and potentially exploitable conditions allowing for arbitrary code execution if an attacker can influence the state of the freed memory before it is reallocated. The ATT&CK framework categorizes this under techniques related to resource manipulation or denial of service through system instability, though exploitation typically requires local access with sufficient privileges to trigger the specific driver initialization path that leads to the error condition.
The root cause stems from a failure in tracking ownership semantics across different subsystem boundaries. The ALSA core expects drivers to relinquish control of private data once it is registered via sc->private_data and sc->private_free, ensuring that cleanup happens exactly once through the standard release mechanism. By retaining an explicit reference to cobsc and attempting manual deallocation after delegating responsibility to the ALSA framework, the driver violates this contract. Static analysis tools identified this discrepancy by tracing pointer lifecycles and detecting redundant free operations on allocated memory blocks within error handling paths that are less frequently exercised than success paths, making such bugs difficult to catch through standard testing alone.
Mitigation for this vulnerability involves removing the explicit kfree(cobsc) call from the err_exit_free path in cobalt_alsa_init. The correct approach is to rely entirely on the ALSA framework's cleanup mechanism by allowing snd_card_free(sc) to handle all associated resource deallocation, including the private data structure. Developers should ensure that once ownership of a memory block is transferred to a subsystem via registration callbacks like sc->private_free, no further manual free operations are performed on that pointer within the driver code. This aligns with best practices for kernel programming where clear separation of concerns and strict adherence to framework lifecycle rules prevent resource management conflicts. Regular static analysis integration into development pipelines helps detect such ownership violations early, reducing the risk of introducing similar double-free vulnerabilities in other drivers or subsystems.