Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-m1za-egnk-w7hc
Vulnerability ID VCID-m1za-egnk-w7hc
Aliases CVE-2026-31475
Summary In the Linux kernel, the following vulnerability has been resolved: ASoC: sma1307: fix double free of devm_kzalloc() memory A previous change added NULL checks and cleanup for allocation failures in sma1307_setting_loaded(). However, the cleanup for mode_set entries is wrong. Those entries are allocated with devm_kzalloc(), so they are device-managed resources and must not be freed with kfree(). Manually freeing them in the error path can lead to a double free when devres later releases the same memory. Drop the manual kfree() loop and let devres handle the cleanup.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-763 Release of Invalid Pointer or Reference
System Score Found at
epss 0.00013 https://api.first.org/data/v1/epss?cve=CVE-2026-31475
epss 0.00013 https://api.first.org/data/v1/epss?cve=CVE-2026-31475
epss 0.00013 https://api.first.org/data/v1/epss?cve=CVE-2026-31475
epss 0.00017 https://api.first.org/data/v1/epss?cve=CVE-2026-31475
epss 0.00017 https://api.first.org/data/v1/epss?cve=CVE-2026-31475
cvssv3.1 5.5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-31475.json
https://api.first.org/data/v1/epss?cve=CVE-2026-31475
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
2460700 https://bugzilla.redhat.com/show_bug.cgi?id=2460700
No exploits are available.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.02217
EPSS Score 0.00013
Published At April 29, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-23T05:41:01.872083+00:00 Debian Importer Import https://security-tracker.debian.org/tracker/data/json 38.4.0