CVE-2025-71192: ALSA: ac97: fix a double free in snd_ac97_controller_register()
In the Linux kernel, the following vulnerability has been resolved:
ALSA: ac97: fix a double free in sndac97controllerregister()
If ac97addadapter() fails, putdevice() is the correct way to drop the device reference. kfree() is not required. Add kfree() if idralloc() fails and in ac97adapterrelease() to do the cleanup.
Found by code review.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Operational
If idr_alloc() fails in snd_ac97_controller_register(), ensure the allocated memory is released with kfree() (i.e., add kfree() on the idr_alloc() failure path).
- Operational
In ac97_adapter_release(), perform the appropriate cleanup (the text instructs to add the kfree() cleanup there).
- Operational
If ac97_add_adapter() fails, use put_device() to drop the device reference as the correct cleanup method.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71192?
CVE-2025-71192 has a severity rating of moderate due to the potential for a double free vulnerability.
How do I fix CVE-2025-71192?
The fix for CVE-2025-71192 involves applying the latest Linux kernel updates that address this double free issue.
What systems are affected by CVE-2025-71192?
CVE-2025-71192 affects versions of the Linux kernel that include the ALSA ac97 sound driver.
What are the risks associated with CVE-2025-71192?
The main risk of CVE-2025-71192 is potential system instability or crashes caused by memory management issues.
Is CVE-2025-71192 actively exploited?
As of now, there are no reports indicating that CVE-2025-71192 is actively being exploited in the wild.