CVE-2026-31475 (GCVE-0-2026-31475)

Vulnerability from cvelistv5 – Published: 2026-04-22 13:54 – Updated: 2026-08-05 12:22
VLAI
Title
ASoC: sma1307: fix double free of devm_kzalloc() memory
Summary
In the Linux kernel, the following vulnerability has been resolved: ASoC: sma1307: fix double free of devm_kzalloc() memory A previous change added NULL checks and cleanup for allocation failures in sma1307_setting_loaded(). However, the cleanup for mode_set entries is wrong. Those entries are allocated with devm_kzalloc(), so they are device-managed resources and must not be freed with kfree(). Manually freeing them in the error path can lead to a double free when devres later releases the same memory. Drop the manual kfree() loop and let devres handle the cleanup.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 0ec6bd16705fe21d6429d6b8f7981eae2142bba8 , < d472d1a52985211b92883bb64bbe710b45980190 (git)
Affected: 0ec6bd16705fe21d6429d6b8f7981eae2142bba8 , < 1a82c3272626db9006f4c2cad3adf2916417aed6 (git)
Affected: 0ec6bd16705fe21d6429d6b8f7981eae2142bba8 , < fe757092d2329c397ecb32f2bf68a5b1c4bd9193 (git)
Affected: f8434b8ba437d3f6cbcd9ffe8405bd16ed28fc5c (git)
Affected: 6.14.9 , < 6.15 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.15
Unaffected: 0 , < 6.15 (semver)
Unaffected: 6.18.21 , ≤ 6.18.* (semver)
Unaffected: 6.19.11 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/soc/codecs/sma1307.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d472d1a52985211b92883bb64bbe710b45980190",
              "status": "affected",
              "version": "0ec6bd16705fe21d6429d6b8f7981eae2142bba8",
              "versionType": "git"
            },
            {
              "lessThan": "1a82c3272626db9006f4c2cad3adf2916417aed6",
              "status": "affected",
              "version": "0ec6bd16705fe21d6429d6b8f7981eae2142bba8",
              "versionType": "git"
            },
            {
              "lessThan": "fe757092d2329c397ecb32f2bf68a5b1c4bd9193",
              "status": "affected",
              "version": "0ec6bd16705fe21d6429d6b8f7981eae2142bba8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f8434b8ba437d3f6cbcd9ffe8405bd16ed28fc5c",
              "versionType": "git"
            },
            {
              "lessThan": "6.15",
              "status": "affected",
              "version": "6.14.9",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/soc/codecs/sma1307.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.21",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.21",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.11",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.14.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: sma1307: fix double free of devm_kzalloc() memory\n\nA previous change added NULL checks and cleanup for allocation\nfailures in sma1307_setting_loaded().\n\nHowever, the cleanup for mode_set entries is wrong. Those entries are\nallocated with devm_kzalloc(), so they are device-managed resources and\nmust not be freed with kfree(). Manually freeing them in the error path\ncan lead to a double free when devres later releases the same memory.\n\nDrop the manual kfree() loop and let devres handle the cleanup."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reachable locally through the ALSA control ioctl for the SMA1307 \"Reset Switch\", which calls `sma1307_reset()` and then `sma1307_setting_loaded()`. There is no network, Bluetooth, WiFi, or other remote packet path to this I2C audio codec driver.\nAC:L - Once an affected SMA1307 device and setting firmware are present, an attacker can repeatedly invoke the reset control to drive the firmware-loading allocations until the `mode_set` allocation failure path is reached. The attacker influences the memory-pressure condition and there is no race requiring victim-controlled timing.\nPR:L - The ioctl path requires local access to the ALSA control device, but the kernel control write path does not require CAP_SYS_ADMIN or real root. This is consistent with a basic local user who has access to the sound card controls.\nUI:N - The attacker can trigger the reset control directly via an ioctl. No separate victim action is required.\nS:U - The corruption occurs in kernel memory within the same host kernel security authority. It does not cross a VM, IOMMU, or similar security boundary.\nC:H - The bug frees devm-managed heap memory with the wrong API, leaving stale devres ownership and creating a double-free/use-after-free style kernel heap corruption condition. Such corruption can reasonably be leveraged for kernel memory disclosure.\nI:H - Kernel heap double-free/use-after-free corruption can be shaped into arbitrary write or control-flow corruption. Under the required overestimation rule, integrity impact is High.\nA:H - The invalid/double free can trigger allocator corruption, kernel warnings/oopses, or panic during the error path or later devres release. Repeated triggering can therefore cause full kernel availability loss."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:22:53.935Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d472d1a52985211b92883bb64bbe710b45980190"
        },
        {
          "url": "https://git.kernel.org/stable/c/1a82c3272626db9006f4c2cad3adf2916417aed6"
        },
        {
          "url": "https://git.kernel.org/stable/c/fe757092d2329c397ecb32f2bf68a5b1c4bd9193"
        }
      ],
      "title": "ASoC: sma1307: fix double free of devm_kzalloc() memory",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31475",
    "datePublished": "2026-04-22T13:54:04.113Z",
    "dateReserved": "2026-03-09T15:48:24.098Z",
    "dateUpdated": "2026-08-05T12:22:53.935Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-31475",
      "date": "2026-09-28",
      "epss": "0.00173",
      "percentile": "0.06022"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "sound/soc/codecs/sma1307.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "d472d1a52985211b92883bb64bbe710b45980190",
                    "status": "affected",
                    "version": "0ec6bd16705fe21d6429d6b8f7981eae2142bba8",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1a82c3272626db9006f4c2cad3adf2916417aed6",
                    "status": "affected",
                    "version": "0ec6bd16705fe21d6429d6b8f7981eae2142bba8",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fe757092d2329c397ecb32f2bf68a5b1c4bd9193",
                    "status": "affected",
                    "version": "0ec6bd16705fe21d6429d6b8f7981eae2142bba8",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "f8434b8ba437d3f6cbcd9ffe8405bd16ed28fc5c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.15",
                    "status": "affected",
                    "version": "6.14.9",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "sound/soc/codecs/sma1307.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.15"
                  },
                  {
                    "lessThan": "6.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.21",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.19.*",
                    "status": "unaffected",
                    "version": "6.19.11",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.0",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2932EEA2-2EDB-4FE6-9BF4-C1F90FF22950",
                    "versionEndExcluding": "6.15",
                    "versionStartIncluding": "6.14.9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "36BA90C1-6493-4928-A360-8DF69289C352",
                    "versionEndExcluding": "6.18.21",
                    "versionStartIncluding": "6.15.1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4CA2E747-A9EC-4518-9AA2-B4247FC748B7",
                    "versionEndExcluding": "6.19.11",
                    "versionStartIncluding": "6.19",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.15:-:*:*:*:*:*:*",
                    "matchCriteriaId": "A1ECC65A-EE37-4479-8E99-4BB68A22A31F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*",
                    "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*",
                    "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: sma1307: fix double free of devm_kzalloc() memory\n\nA previous change added NULL checks and cleanup for allocation\nfailures in sma1307_setting_loaded().\n\nHowever, the cleanup for mode_set entries is wrong. Those entries are\nallocated with devm_kzalloc(), so they are device-managed resources and\nmust not be freed with kfree(). Manually freeing them in the error path\ncan lead to a double free when devres later releases the same memory.\n\nDrop the manual kfree() loop and let devres handle the cleanup."
          }
        ],
        "id": "CVE-2026-31475",
        "lastModified": "2026-06-17T10:33:48.793",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-04-22T14:16:44.207",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/1a82c3272626db9006f4c2cad3adf2916417aed6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d472d1a52985211b92883bb64bbe710b45980190"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/fe757092d2329c397ecb32f2bf68a5b1c4bd9193"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-415"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-28T11:23:32+00:00",
      "cve": "CVE-2026-31475",
      "id": "CVE-2026-31475",
      "initial_release_date": "2026-04-22T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ASoC: sma1307: fix double free of devm_kzalloc() memory",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31475.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-03T23:48:58Z",
      "cve": "CVE-2026-31475",
      "id": "CVE-2026-31475",
      "initial_release_date": "2026-04-23T01:25:48Z",
      "product_status:known_not_affected": "315",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-31475",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-31475.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.