CVE-2026-56109: ALSA Library < 1.2.16.1 Double-Free via parse_def() in conf.c
Last updated 7 July 2026
Other sources
The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free vulnerability in parsedef() in src/conf.c that allows attackers to corrupt memory by supplying maliciously crafted ALSA configuration text. When parsing nested compound or array configuration blocks, parsedef() fails to check return values before continuing, causing sndconfigdelete() to be called twice on the same already-freed node, resulting in a NULL-pointer write or invalid memory read.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/alsa-libto a version that resolves this vulnerability.Fixed in 1.2.16.1-1 - Upgrade
Upgrade
ALSA Libraryto a version that resolves this vulnerability.Fixed in 1.2.16.1 - Compensating control
If you handle untrusted ALSA configuration text, ensure attackers cannot supply or influence ALSA configuration that is parsed by snd_config/parse_def (e.g., restrict who can modify ALSA config files and only load configurations from trusted sources).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56109?
The severity of CVE-2026-56109 is rated as high with a score of 7.
How do I fix CVE-2026-56109?
To fix CVE-2026-56109, upgrade the ALSA library to version 1.2.16.1 or later.
What type of vulnerability is CVE-2026-56109?
CVE-2026-56109 is classified as a double-free vulnerability.
What impact does CVE-2026-56109 have?
CVE-2026-56109 allows attackers to corrupt memory through maliciously crafted ALSA configuration text.
In which component does CVE-2026-56109 occur?
CVE-2026-56109 occurs in the parse_def() function within the ALSA library's src/conf.c file.