CVE-2025-71192ALSA: ac97: fix a double free in snd_ac97_controller_register()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: ALSA: ac97: fix a double free in snd_ac97_controller_register() If ac97_add_adapter() fails, put_device() is the correct way to drop the device reference. kfree() is not required. Add kfree() if idr_alloc() fails and in ac97_adapter_release() to do the cleanup. Found by code review.
- CVSS
- 7.0 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Deferred
- Record last updated
- Aug 5, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 74426fbff66eea8e8d1f42c8238c268d1e63a832 before c80f9b3349a99a9d5b295f5bbc23f544c5995ad7; 74426fbff66eea8e8d1f42c8238c268d1e63a832 builds before 21f8bc5179bed91c3f946adb5e55d717b891960c; from 74426fbff66eea8e8d1f42c8238c268d1e63a832 before fcc04c92cbb5497ce67c58dd2f0001bb87f40396; from 74426fbff66eea8e8d1f42c8238c268d1e63a832 before cb73d37ac18bc1716690ff5255a0ef1952827e9e; from 74426fbff66eea8e8d1f42c8238c268d1e63a832 before 830988b6cf197e6dcffdfe2008c5738e6c6c3c0f | CNA record |
References
- https://git.kernel.org/stable/c/c80f9b3349a99a9d5b295f5bbc23f544c5995ad7
- https://git.kernel.org/stable/c/21f8bc5179bed91c3f946adb5e55d717b891960c
- https://git.kernel.org/stable/c/fcc04c92cbb5497ce67c58dd2f0001bb87f40396
- https://git.kernel.org/stable/c/cb73d37ac18bc1716690ff5255a0ef1952827e9e
- https://git.kernel.org/stable/c/830988b6cf197e6dcffdfe2008c5738e6c6c3c0f
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.