CVE-2026-89895: media: cobalt: Avoid freeing ALSA private data twice
In the Linux kernel, the following vulnerability has been resolved:
media: cobalt: Avoid freeing ALSA private data twice
sndcobaltcardcreate() stores cobsc in sc->privatedata and installs sndcobaltcardprivatefree() as sc->privatefree. From that point, sndcardfree(sc) releases cobsc through the ALSA card cleanup path.
If cobaltalsainit() fails after sndcobaltcardcreate(), the errexitfree path calls sndcardfree(sc) and then kfree(cobsc). That second free releases the same object again.
Remove the explicit kfree(cobsc) and leave ownership with the ALSA card.
This issue was found by a static analysis checker and confirmed by manual source review.
Affected Software
Event History
Frequently Asked Questions
Under what condition can the double free occur?
It occurs when cobalt_alsa_init() fails after snd_cobalt_card_create() has stored the private data on the ALSA card and registered its private-free callback. The error path then frees the ALSA card and explicitly frees the same private object again.
What code change resolves the issue?
The explicit kfree(cobsc) in the error cleanup path must be removed. Once snd_cobalt_card_create() succeeds, ownership of cobsc belongs to the ALSA card cleanup path invoked by snd_card_free(sc).
How was this issue identified?
A static analysis checker identified the issue, and it was confirmed through manual source review.