Skip to main content

Linux Kernel CVE-2026-31475

| EUVDEUVD-2026-24830 HIGH
Double Free (CWE-415)
2026-04-22 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SUSE
HIGH
qualitative
Red Hat
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

8
Re-analysis Queued
Apr 27, 2026 - 23:37 vuln.today
cvss_changed
Patch released
Apr 27, 2026 - 23:25 nvd
Patch available
Analysis Generated
Apr 27, 2026 - 14:32 vuln.today
CVSS changed
Apr 27, 2026 - 14:22 NVD
7.8 (HIGH)
Patch available
Apr 22, 2026 - 16:33 EUVD
EUVD ID Assigned
Apr 22, 2026 - 14:22 euvd
EUVD-2026-24830
Analysis Generated
Apr 22, 2026 - 14:22 vuln.today
CVE Published
Apr 22, 2026 - 14:16 nvd
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ASoC: sma1307: fix double free of devm_kzalloc() memory

A previous change added NULL checks and cleanup for allocation failures in sma1307_setting_loaded().

However, the cleanup for mode_set entries is wrong. Those entries are allocated with devm_kzalloc(), so they are device-managed resources and must not be freed with kfree(). Manually freeing them in the error path can lead to a double free when devres later releases the same memory.

Drop the manual kfree() loop and let devres handle the cleanup.

AnalysisAI

Memory corruption in the Linux kernel sma1307 ASoC driver allows local authenticated users to trigger a double-free condition leading to potential privilege escalation, denial of service, or information disclosure. The vulnerability stems from improper cleanup of device-managed memory allocations in error paths within the sma1307_setting_loaded() function, where devm_kzalloc()-allocated resources are incorrectly freed with kfree(), causing devres to later release the same memory a second time. Vendor patches are available across multiple stable kernel branches (6.18.21, 6.19.11, 7.0). EPSS score of 0.02% (4th percentile) indicates low observed exploitation probability, and no active exploitation or public POC has been identified.

Technical ContextAI

This vulnerability affects the ASoC (ALSA System on Chip) subsystem's SMA1307 audio amplifier driver in the Linux kernel. The issue involves improper resource management in error handling paths. The devm_kzalloc() function allocates memory using the kernel's device resource management (devres) framework, which automatically releases resources when the device is detached or the driver is unloaded. A prior code change added error path cleanup that incorrectly calls kfree() on these device-managed allocations in sma1307_setting_loaded(). This violates devres semantics because the memory will be freed again when devres cleanup runs, creating a use-after-free/double-free condition. This type of memory safety violation can lead to heap corruption, kernel crashes, or exploitable conditions for privilege escalation. The affected code appears in commits starting from 0ec6bd16705fe21d6429d6b8f7981eae2142bba8, with fixes merged in commits 1a82c3272626db9006f4c2cad3adf2916417aed6, d472d1a52985211b92883bb64bbe710b45980190, and fe757092d2329c397ecb32f2bf68a5b1c4bd9193 across multiple stable kernel branches.

RemediationAI

Upgrade to patched Linux kernel versions: 6.18.21, 6.19.11, or 7.0 and later from official distribution channels. Distribution-specific kernel packages from Red Hat, Ubuntu, Debian, SUSE, and others will incorporate these fixes in their security update streams. Patches can be reviewed and applied from upstream commits at https://git.kernel.org/stable/c/1a82c3272626db9006f4c2cad3adf2916417aed6, https://git.kernel.org/stable/c/d472d1a52985211b92883bb64bbe710b45980190, and https://git.kernel.org/stable/c/fe757092d2329c397ecb32f2bf68a5b1c4bd9193. For environments unable to immediately upgrade, workarounds include unloading or blacklisting the sma1307 kernel module if the SMA1307 audio hardware is not in use (add 'blacklist snd_soc_sma1307' to /etc/modprobe.d/blacklist.conf and rebuild initramfs). Note this workaround completely disables SMA1307 audio functionality. Alternatively, restrict local user access and monitor for suspicious kernel module loading activity, though this provides minimal protection against authenticated local users. No runtime configuration changes can mitigate the vulnerability without removing the driver entirely. Standard kernel live-patching mechanisms (kpatch, kGraft, Ksplice) may provide non-disruptive remediation for supported enterprise distributions.

Same weakness CWE-415 – Double Free

View all
CVE-2014-0502 HIGH POC
8.8
CVE-2023-25136 MEDIUM POC
6.5
CVE-2014-1767 HIGH POC
7.2
CVE-2016-5768 CRITICAL POC
9.8
CVE-2016-5772 CRITICAL POC
9.8
CVE-2016-3132 CRITICAL POC
9.8
CVE-2017-6074 HIGH POC
7.8
CVE-2017-9287 MEDIUM POC
6.5

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-31475 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy