CVE-2025-71192

ALSA: ac97: fix a double free in snd_ac97_controller_register()

State: Published
Severity: 7.0 High
Published: Feb 4, 2026
Updated: Aug 5, 2026
Reserved: Jan 31, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: ac97: fix a double free in snd_ac97_controller_register()

If ac97_add_adapter() fails, put_device() is the correct way to drop the device reference. kfree() is not required. Add kfree() if idr_alloc() fails and in ac97_adapter_release() to do the cleanup.

Found by code review.

Scores

CVSS	Score	Vector	Source
3.1	7.0 High	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	74426fbff66eea8e8d1f42c8238c268d1e63a832 to before c80f9b3349a99a9d5b295f5bbc23f544c5995ad7Affected 74426fbff66eea8e8d1f42c8238c268d1e63a832 to before 21f8bc5179bed91c3f946adb5e55d717b891960cAffected 74426fbff66eea8e8d1f42c8238c268d1e63a832 to before fcc04c92cbb5497ce67c58dd2f0001bb87f40396Affected 74426fbff66eea8e8d1f42c8238c268d1e63a832 to before cb73d37ac18bc1716690ff5255a0ef1952827e9eAffected 74426fbff66eea8e8d1f42c8238c268d1e63a832 to before 830988b6cf197e6dcffdfe2008c5738e6c6c3c0fAffected
LinuxLinux	4.15Affected before 4.15Not affected 6.1.161 through 6.1.Not affected 6.6.121 through 6.6.Not affected 6.12.66 through 6.12.Not affected 6.18.6 through 6.18.Not affected 6.19 and laterNot affected

Product

Versions

LinuxLinux

74426fbff66eea8e8d1f42c8238c268d1e63a832 to before c80f9b3349a99a9d5b295f5bbc23f544c5995ad7Affected
74426fbff66eea8e8d1f42c8238c268d1e63a832 to before 21f8bc5179bed91c3f946adb5e55d717b891960cAffected
74426fbff66eea8e8d1f42c8238c268d1e63a832 to before fcc04c92cbb5497ce67c58dd2f0001bb87f40396Affected
74426fbff66eea8e8d1f42c8238c268d1e63a832 to before cb73d37ac18bc1716690ff5255a0ef1952827e9eAffected
74426fbff66eea8e8d1f42c8238c268d1e63a832 to before 830988b6cf197e6dcffdfe2008c5738e6c6c3c0fAffected

LinuxLinux

4.15Affected
before 4.15Not affected
6.1.161 through 6.1.*Not affected
6.6.121 through 6.6.*Not affected
6.12.66 through 6.12.*Not affected
6.18.6 through 6.18.*Not affected
6.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.