Strix
26.1K

CVE-2025-71192

HIGHCVSS 7/10EPSS 0.16%

Last modified

CVE-2025-71192 is a high-severity vulnerability rated 7/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: ALSA: ac97: fix a double free in snd_ac97_controller_register() If ac97_add_adapter() fails, put_device() is the correct way to drop the device reference. kfree() is not required. Add kfree() if idr_alloc() fails and in ac97_adapter_release() to do the cleanup. Found by code review.. EPSS estimates a 0.16% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: ac97: fix a double free in snd_ac97_controller_register() If ac97_add_adapter() fails, put_device() is the correct way to drop the device reference. kfree() is not required. Add kfree() if idr_alloc() fails and in ac97_adapter_release() to do the cleanup. Found by code review.

Metrics

CVSS 3.1
7/10

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
0.16%

5.3th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 74426fbff66eea8e8d1f42c8238c268d1e63a832, < c80f9b3349a99a9d5b295f5bbc23f544c5995ad7; >= 74426fbff66eea8e8d1f42c8238c268d1e63a832, < 21f8bc5179bed91c3f946adb5e55d717b891960c; >= 74426fbff66eea8e8d1f42c8238c268d1e63a832, < fcc04c92cbb5497ce67c58dd2f0001bb87f40396; >= 74426fbff66eea8e8d1f42c8238c268d1e63a832, < cb73d37ac18bc1716690ff5255a0ef1952827e9e; >= 74426fbff66eea8e8d1f42c8238c268d1e63a832, < 830988b6cf197e6dcffdfe2008c5738e6c6c3c0f
LinuxLinux4.15

References

Timeline

Published
Last Modified
Status
Deferred

Frequently Asked Questions

What is CVE-2025-71192?
In the Linux kernel, the following vulnerability has been resolved: ALSA: ac97: fix a double free in snd_ac97_controller_register() If ac97_add_adapter() fails, put_device() is the correct way to drop the device reference. kfree() is not required. Add kfree() if idr_alloc() fails and in ac97_adapter_release() to do the cleanup. Found by code review.
How severe is CVE-2025-71192?
CVE-2025-71192 has a CVSS score of 7/10 (HIGH severity). The EPSS model estimates a 0.16% probability of exploitation in the next 30 days.
How do I fix CVE-2025-71192?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2025

View all 2025CVEs →

Are you affected by CVE-2025-71192?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST