Description
In the Linux kernel, the following vulnerability has been resolved: media: cobalt: Avoid freeing ALSA private data twice snd_cobalt_card_create() stores cobsc in sc->private_data and installs snd_cobalt_card_private_free() as sc->private_free. From that point, snd_card_free(sc) releases cobsc through the ALSA card cleanup path. If cobalt_alsa_init() fails after snd_cobalt_card_create(), the err_exit_free path calls snd_card_free(sc) and then kfree(cobsc). That second free releases the same object again. Remove the explicit kfree(cobsc) and leave ownership with the ALSA card. This issue was found by a static analysis checker and confirmed by manual source review.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
85756a069c55e0315ac5990806899cfb607b987f to < 75bbf45e3a954e292ae26832d2df40ca2e3ee452affected85756a069c55e0315ac5990806899cfb607b987f to < fe65028ee72a7e07e572b351891bd7a1f8917d33affected85756a069c55e0315ac5990806899cfb607b987f to < 61dfa8ded5efc3a25d331fa9ce5cebb85531fe70affected85756a069c55e0315ac5990806899cfb607b987f to < 42e00371f83c3fc7b99a36bf0229c74ad5d3c7d8affected85756a069c55e0315ac5990806899cfb607b987f to < 6cbc8a73b3464ebeccc49987b7233b6b087b8504affected85756a069c55e0315ac5990806899cfb607b987f to < cb1218da234ea15fa14d90e2d049d686874d7aa3affected85756a069c55e0315ac5990806899cfb607b987f to < 8c6610e230b9355cf7df5a338a0592c0f088c00baffected85756a069c55e0315ac5990806899cfb607b987f to < 3a7d6b9c4cb5ac18cbd3f1c7f8c7b159c42ba0b1affected
Linux Linux
Default version status: affected
4.2affected0 to < 4.2unaffected5.10.270 to ≤ 5.10.*unaffected5.15.221 to ≤ 5.15.*unaffected6.1.188 to ≤ 6.1.*unaffected6.6.157 to ≤ 6.6.*unaffected6.12.110 to ≤ 6.12.*unaffected6.18.51 to ≤ 6.18.*unaffected7.2.5 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/75bbf45e3a954e292ae26832d2df40ca2e3ee452 ↗
- https://git.kernel.org/stable/c/fe65028ee72a7e07e572b351891bd7a1f8917d33 ↗
- https://git.kernel.org/stable/c/61dfa8ded5efc3a25d331fa9ce5cebb85531fe70 ↗
- https://git.kernel.org/stable/c/42e00371f83c3fc7b99a36bf0229c74ad5d3c7d8 ↗
- https://git.kernel.org/stable/c/6cbc8a73b3464ebeccc49987b7233b6b087b8504 ↗
- https://git.kernel.org/stable/c/cb1218da234ea15fa14d90e2d049d686874d7aa3 ↗
- https://git.kernel.org/stable/c/8c6610e230b9355cf7df5a338a0592c0f088c00b ↗
- https://git.kernel.org/stable/c/3a7d6b9c4cb5ac18cbd3f1c7f8c7b159c42ba0b1 ↗