https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-01T07:35:05.316877+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/bell-cve-2026-89895 BELL-CVE-2026-89895 2026-10-01T07:35:05.381807+00:00

Affected: Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts

 https://vulnerability.circl.lu/vuln/fkie_cve-2026-89895 fkie_cve-2026-89895 2026-10-01T07:35:05.381902+00:00

In the Linux kernel, the following vulnerability has been resolved:

media: cobalt: Avoid freeing ALSA private data twice

snd_cobalt_card_create() stores cobsc in sc->private_data and installs snd_cobalt_card_private_free() as sc->private_free. From that point, snd_card_free(sc) releases cobsc through the ALSA card cleanup path.

If cobalt_alsa_init() fails after snd_cobalt_card_create(), the err_exit_free path calls snd_card_free(sc) and then kfree(cobsc). That second free releases the same object again.

Remove the explicit kfree(cobsc) and leave ownership with the ALSA card.

This issue was found by a static analysis checker and confirmed by manual source review.

 https://vulnerability.circl.lu/vuln/ghsa-r63g-3mcq-69jv GHSA-r63g-3mcq-69jv 2026-10-01T07:35:05.381972+00:00

In the Linux kernel, the following vulnerability has been resolved:

media: cobalt: Avoid freeing ALSA private data twice

snd_cobalt_card_create() stores cobsc in sc->private_data and installs snd_cobalt_card_private_free() as sc->private_free. From that point, snd_card_free(sc) releases cobsc through the ALSA card cleanup path.

If cobalt_alsa_init() fails after snd_cobalt_card_create(), the err_exit_free path calls snd_card_free(sc) and then kfree(cobsc). That second free releases the same object again.

Remove the explicit kfree(cobsc) and leave ownership with the ALSA card.

This issue was found by a static analysis checker and confirmed by manual source review.

 https://vulnerability.circl.lu/vuln/opensuse-su-2026:11880-1 openSUSE-SU-2026:11880-1 — kernel-devel-7.2.7-1.1 on GA media 2026-10-01T07:35:05.382016+00:00

kernel-devel-7.2.7-1.1 on GA media

 https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-89895 UBUNTU-CVE-2026-89895 2026-10-01T07:35:05.382638+00:00

Affected: Ubuntu:Pro:14.04:LTS: linux-aws, Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:14.04:LTS: linux-lts-xenial, Ubuntu:Pro:16.04:LTS: linux, Ubuntu:Pro:16.04:LTS: linux-aws, Ubuntu:Pro:16.04:LTS: linux-aws-hwe, Ubuntu:Pro:16.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-gcp, Ubuntu:Pro:16.04:LTS: linux-hwe, Ubuntu:16.04:LTS: linux-hwe-edge and 245 more

In the Linux kernel, the following vulnerability has been resolved: media: cobalt: Avoid freeing ALSA private data twice snd_cobalt_card_create() stores cobsc in sc->private_data and installs snd_cobalt_card_private_free() as sc->private_free. From that point, snd_card_free(sc) releases cobsc through the ALSA card cleanup path. If cobalt_alsa_init() fails after snd_cobalt_card_create(), the err_exit_free path calls snd_card_free(sc) and then kfree(cobsc). That second free releases the same object again. Remove the explicit kfree(cobsc) and leave ownership with the ALSA card. This issue was found by a static analysis checker and confirmed by manual source review.