Executive brief
A vulnerability was identified in the Linux kernel's audio subsystem (ALSA) specifically affecting AC97 sound controllers. A flaw in how the system handles errors during hardware initialization could lead to a system crash or memory corruption. This issue primarily impacts system stability and could potentially be used to disrupt operations on affected Linux systems.
Technical details
A double-free vulnerability exists in sound/ac97/bus.c within the snd_ac97_controller_register() function. The root cause is improper error handling where kfree() was called on a controller object even after a failed ac97_add_adapter() call had already triggered a reference count drop via put_device(). An attacker with local access could potentially trigger this condition during device initialization to cause memory corruption or a Denial of Service (DoS). The fix ensures that memory is only freed once by moving the kfree() call to the appropriate release callback and removing redundant calls in the error path.
Affected products
- Linux Linux Kernel 4.15 to 6.1.160, 6.6.120, 6.12.65, 6.18.5
Timeline
- 2025-12-23: patched: Initial fix committed to mainline kernel
- 2026-02-04: disclosed: CVE-2025-71192 published
References
- https://git.kernel.org/stable/c/21f8bc5179bed91c3f946adb5e55d717b891960c
- https://git.kernel.org/stable/c/830988b6cf197e6dcffdfe2008c5738e6c6c3c0f
- https://git.kernel.org/stable/c/c80f9b3349a99a9d5b295f5bbc23f544c5995ad7
- https://git.kernel.org/stable/c/cb73d37ac18bc1716690ff5255a0ef1952827e9e
- https://git.kernel.org/stable/c/fcc04c92cbb5497ce67c58dd2f0001bb87f40396