CVE-2026-31475
7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved:
ASoC: sma1307: fix double free of devm_kzalloc() memory
A previous change added NULL checks and cleanup for allocation failures in sma1307_setting_loaded().
However, the cleanup for mode_set entries is wrong. Those entries are allocated with devm_kzalloc(), so they are device-managed resources and must not be freed with kfree(). Manually freeing them in the error path can lead to a double free when devres later releases the same memory.
Drop the manual kfree() loop and let devres handle the cleanup.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 0ec6bd16705fe21d6429d6b8f7981eae2142bba8 < d472d1a52985211b92883bb64bbe710b45980190 | affected |
| Linux | Linux | 0ec6bd16705fe21d6429d6b8f7981eae2142bba8 < 1a82c3272626db9006f4c2cad3adf2916417aed6 | affected |
| Linux | Linux | 0ec6bd16705fe21d6429d6b8f7981eae2142bba8 < fe757092d2329c397ecb32f2bf68a5b1c4bd9193 | affected |
| Linux | Linux | f8434b8ba437d3f6cbcd9ffe8405bd16ed28fc5c | affected |
| Linux | Linux | 6.14.9 < 6.15 | affected |
| Linux | Linux | 6.15 | affected |
| Linux | Linux | 0 < 6.15 | unaffected |
| Linux | Linux | 6.18.21 <= 6.18.* | unaffected |
| Linux | Linux | 6.19.11 <= 6.19.* | unaffected |
| Linux | Linux | 7.0 <= * | unaffected |
Weaknesses
References
- https://git.kernel.org/stable/c/d472d1a52985211b92883bb64bbe710b45980190
- https://git.kernel.org/stable/c/1a82c3272626db9006f4c2cad3adf2916417aed6
- https://git.kernel.org/stable/c/fe757092d2329c397ecb32f2bf68a5b1c4bd9193
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.