Executive brief
The Linux kernel's Cobalt media driver contains a memory management bug in its audio (ALSA) card initialization code. When audio device setup fails, the kernel attempts to free the same memory block twice, which can lead to kernel crashes or undefined behavior. This affects systems with Cobalt video capture hardware running vulnerable kernel versions.
Technical details
This is a double-free vulnerability in the Cobalt ALSA (Advanced Linux Sound Architecture) initialization code. The vulnerable function cobalt_alsa_init() calls snd_cobalt_card_create(), which registers a private data cleanup callback (snd_cobalt_card_private_free()) with the ALSA subsystem. If initialization fails after that point, the error path calls snd_card_free() to release the card (which triggers the cleanup callback and frees the private data), then explicitly calls kfree() on the same object again. The fix removes the redundant explicit free, leaving all memory management to the ALSA card cleanup path. The vulnerability requires the Cobalt device driver to be loaded and initialization to fail at a specific point; it cannot be exploited remotely but may cause kernel denial of service on affected systems.
Affected products
- Linux Linux Kernel multiple kernel versions from 2.6 through 6.x (see Linux stable tree branches)
Timeline
- 2026-09-16: disclosed: CVE-2026-89895 published
- 2026-07-15: patched: Upstream fix committed by Hans Verkuil