CVE-2026-89895: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89895 Overview

CVE-2026-89895 is a double-free vulnerability in the Linux kernel's cobalt media driver. The flaw resides in the ALSA (Advanced Linux Sound Architecture) initialization path used by the Cobalt video capture card driver. When cobalt_alsa_init() fails after snd_cobalt_card_create() succeeds, the error cleanup path releases the same cobsc private data object twice. Static analysis identified the issue and manual source review confirmed it. The vulnerability is classified as a [CWE-415] Double Free in kernel memory management code.

Critical Impact
A double free in the ALSA card cleanup path can corrupt kernel heap metadata, leading to memory corruption, denial of service, or potential local privilege escalation on systems with the Cobalt driver loaded.

Affected Products

Linux kernel media/cobalt driver (Cobalt video capture card support)
Linux kernel builds compiled with CONFIG_VIDEO_COBALT and ALSA support
Stable kernel branches referenced by the fix commits 3a7d6b9, 42e0037, 61dfa8d, 6cbc8a7, 75bbf45, 8c6610e, cb1218d, and fe65028

Discovery Timeline

2026-09-16 - CVE-2026-89895 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89895

Vulnerability Analysis

The Cobalt media driver integrates with ALSA to expose an audio device alongside its video capture functionality. During initialization, snd_cobalt_card_create() allocates a private context structure (cobsc), stores it in sc->private_data, and registers snd_cobalt_card_private_free() as the sc->private_free callback. From that moment, ownership of cobsc transfers to the ALSA card. Any subsequent call to snd_card_free(sc) invokes the registered private_free callback and releases cobsc through the standard ALSA cleanup path.

The defect appears in the error handling logic of cobalt_alsa_init(). If initialization fails after snd_cobalt_card_create() returns successfully, the err_exit_free label calls snd_card_free(sc) and then explicitly invokes kfree(cobsc). Because ALSA has already released the object through the private_free callback, the explicit kfree() frees the same allocation a second time.

Root Cause

The root cause is duplicate ownership of the cobsc structure during error cleanup. The code fails to account for the ownership transfer that occurs when snd_cobalt_card_create() installs the private_free callback. The upstream fix removes the redundant kfree(cobsc) call and leaves ownership solely with the ALSA card.

Attack Vector

Triggering the flaw requires the failure of cobalt_alsa_init() after successful card creation on a system with the Cobalt driver bound to hardware. An attacker with the ability to induce initialization failures, such as through resource exhaustion or by controlling probe conditions on systems that load the driver, could trigger the double free. Successful exploitation of a kernel double free can corrupt the SLUB allocator freelist and lead to arbitrary write primitives suitable for local privilege escalation. Refer to the upstream commits in the kernel.org stable tree for the exact code path.

Detection Methods for CVE-2026-89895

Indicators of Compromise

Kernel oops or panic messages referencing snd_cobalt_card_private_free or the SLUB allocator (kernel BUG at mm/slub.c) shortly after loading the cobalt module
dmesg entries showing repeated kfree warnings or double free or corruption errors correlated with Cobalt driver probe failures
Unexpected reboots or crashes on hosts equipped with Cobalt capture hardware

Detection Strategies

Inventory Linux hosts to identify kernels built with CONFIG_VIDEO_COBALT and compare running versions against the patched stable releases
Enable CONFIG_SLUB_DEBUG and KASAN on test builds to surface double-free conditions during driver initialization
Monitor kernel ring buffer output for allocator corruption warnings tied to ALSA card teardown

Monitoring Recommendations

Forward dmesg and journald kernel logs to a centralized logging platform and alert on double free, use-after-free, and slab corruption strings
Track module load and unload events for the cobalt and snd modules on affected hosts
Correlate host crashes with recent driver initialization attempts to identify exploitation attempts against the flaw

How to Mitigate CVE-2026-89895

Immediate Actions Required

Apply the stable kernel updates that include commits 3a7d6b9, 42e0037, 61dfa8d, 6cbc8a7, 75bbf45, 8c6610e, cb1218d, or fe65028 corresponding to your kernel branch
If patching is not immediately possible, blacklist the cobalt kernel module on hosts that do not require the hardware
Restrict local access on systems that expose the driver to reduce the attack surface for triggering initialization failures

Patch Information

The fix removes the explicit kfree(cobsc) from the err_exit_free path in cobalt_alsa_init(), leaving the ALSA card responsible for releasing the private data via snd_cobalt_card_private_free(). Distribution maintainers have backported the change across multiple stable branches. Review the specific commits at the Linux kernel stable git tree and consult your distribution's advisory for package versions.

Workarounds

Blacklist the module by adding blacklist cobalt to /etc/modprobe.d/cobalt-blacklist.conf on systems that do not use the capture hardware
Physically remove or disable Cobalt PCIe capture cards on hosts pending kernel updates
Limit unprivileged local access to reduce the risk of an attacker triggering the vulnerable code path

bash

# Configuration example
echo "blacklist cobalt" | sudo tee /etc/modprobe.d/cobalt-blacklist.conf
sudo depmod -a
sudo update-initramfs -u