CVE-2026-89895
Last modified
CVE-2026-89895 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: media: cobalt: Avoid freeing ALSA private data twice snd_cobalt_card_create() stores cobsc in sc->private_data and installs snd_cobalt_card_private_free() as sc->private_free. From that point, snd_card_free(sc) releases cobsc through the ALSA card cleanup path. If cobalt_alsa_init() fails after snd_cobalt_card_create(), the err_exit_free path calls snd_card_free(sc) and then kfree(cobsc).
Description
In the Linux kernel, the following vulnerability has been resolved: media: cobalt: Avoid freeing ALSA private data twice snd_cobalt_card_create() stores cobsc in sc->private_data and installs snd_cobalt_card_private_free() as sc->private_free. From that point, snd_card_free(sc) releases cobsc through the ALSA card cleanup path. If cobalt_alsa_init() fails after snd_cobalt_card_create(), the err_exit_free path calls snd_card_free(sc) and then kfree(cobsc). That second free releases the same object again. Remove the explicit kfree(cobsc) and leave ownership with the ALSA card. This issue was found by a static analysis checker and confirmed by manual source review.
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | >= 85756a069c55e0315ac5990806899cfb607b987f, < 75bbf45e3a954e292ae26832d2df40ca2e3ee452; >= 85756a069c55e0315ac5990806899cfb607b987f, < fe65028ee72a7e07e572b351891bd7a1f8917d33; >= 85756a069c55e0315ac5990806899cfb607b987f, < 61dfa8ded5efc3a25d331fa9ce5cebb85531fe70; >= 85756a069c55e0315ac5990806899cfb607b987f, < 42e00371f83c3fc7b99a36bf0229c74ad5d3c7d8; >= 85756a069c55e0315ac5990806899cfb607b987f, < 6cbc8a73b3464ebeccc49987b7233b6b087b8504; >= 85756a069c55e0315ac5990806899cfb607b987f, < cb1218da234ea15fa14d90e2d049d686874d7aa3; >= 85756a069c55e0315ac5990806899cfb607b987f, < 8c6610e230b9355cf7df5a338a0592c0f088c00b; >= 85756a069c55e0315ac5990806899cfb607b987f, < 3a7d6b9c4cb5ac18cbd3f1c7f8c7b159c42ba0b1 |
| Linux | Linux | 4.2 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-89895?
How severe is CVE-2026-89895?
How do I fix CVE-2026-89895?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-8989Autel Maxi Charger Single firmware through V1.03.51 permits …6.8
- CVE-2026-89890In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2026-89891In the Linux kernel, the following vulnerability has been re…
- CVE-2026-89892In the Linux kernel, the following vulnerability has been re…
- CVE-2026-89893In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2026-89894In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2026-89896In the Linux kernel, the following vulnerability has been re…
- CVE-2026-89897In the Linux kernel, the following vulnerability has been re…7.5
- CVE-2026-89898In the Linux kernel, the following vulnerability has been re…8.8
- CVE-2026-89899In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2026-8990A user with physical access to a smartphone can bypass authe…5.3
- CVE-2026-89900In the Linux kernel, the following vulnerability has been re…
Are you affected by CVE-2026-89895?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST