Medium 5.5Published Jun 26, 2026

CVE-2026-53291ALSA: hda/conexant: Fix missing error check for jack detection

Updated under an hour ago (Oct 26, 2026, 8:40 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/conexant: Fix missing error check for jack detection In cx_probe(), the return value of snd_hda_jack_detect_enable_callback() is ignored. This function returns a pointer, and if it fails (e.g., due to memory allocation failure), it returns an error pointer which must be checked using IS_ERR(). If the registration fails, the driver continues to probe, but the jack detection callback will not be registered. This can lead to a kernel crash later when the driver attempts to handle jack events or accesses the uninitialized structure. Check the return value using IS_ERR() and propagate the error via PTR_ERR() to the probe caller.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Jun 26, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from f13b8cb5a6920ad98b751d3134686f29810577d4 before 49c2c5924552e1d2f8b635dee663abebbb7cf63b; from 2cb659ef0ac744545499e7c37665b276d9e405da before a2a33e87a2ffce3046c574d24eec4390c27c9365; from 24d748413cc4e1d97074bae1f335d32d30912f10 before d68f753d89f4ef6e410d7e8b7e8ab2fdde921b80; from 7aeb259086487417f0fecf66e325bee133e8813a before dd110cc00cf854a8ecd8d003127a4178c28574ea; from 7aeb259086487417f0fecf66e325bee133e8813a before f837c7b85143a7c54140ff41ad5c076b73cd9933; 7aeb259086487417f0fecf66e325bee133e8813a builds before 1da5c73f3793b224696617a2a21def7500ba18d6; from 7aeb259086487417f0fecf66e325bee133e8813a before b0e2333a231107adedd38c6fcfe1adc6162716fc; 4a28302b2c681e3cf85e3b41231fff363c4c6a0e; and 4 more ranges	CNA record
linux linux_kernel linux:linux_kernel	from 5.15.149 before 5.15.209; from 6.1.77 before 6.1.175; from 6.6.16 before 6.6.141; from 6.7.4 before 6.12.91; from 6.13 before 6.18.33; from 6.19 before 7.0.10; 7.1	NVD

References

References

https://git.kernel.org/stable/c/49c2c5924552e1d2f8b635dee663abebbb7cf63b	patch
https://git.kernel.org/stable/c/a2a33e87a2ffce3046c574d24eec4390c27c9365	patch
https://git.kernel.org/stable/c/d68f753d89f4ef6e410d7e8b7e8ab2fdde921b80	patch
https://git.kernel.org/stable/c/dd110cc00cf854a8ecd8d003127a4178c28574ea	patch
https://git.kernel.org/stable/c/f837c7b85143a7c54140ff41ad5c076b73cd9933	patch
https://git.kernel.org/stable/c/1da5c73f3793b224696617a2a21def7500ba18d6	patch
https://git.kernel.org/stable/c/b0e2333a231107adedd38c6fcfe1adc6162716fc	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.