CVE-2025-71192: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71192 is a double-free vulnerability in the Linux kernel's ALSA AC97 audio subsystem, specifically within the snd_ac97_controller_register() function. The flaw was discovered through code review and disclosed on February 4, 2026. It affects Linux kernel versions from 4.15 up to the patched stable releases (6.1.161, 6.6.121, 6.12.66, 6.18.6, and 6.19-rc5). The CVSS estimate is Medium severity, with an EPSS score of approximately 0.024% (Feedly, EUVD).

The root cause is a double-free memory management error (CWE-415) in the ALSA AC97 controller registration path. When ac97_add_adapter() fails, the code incorrectly calls kfree() on a device object that should instead be released via put_device(), which handles the reference-counted device cleanup properly. Additionally, kfree() was missing in the idr_alloc() failure path and in ac97_adapter_release(), leading to both double-free and memory leak conditions. The fix corrects the cleanup logic in all three paths (Feedly, EUVD).

Exploitation of this double-free vulnerability could lead to kernel memory corruption, potentially causing a system crash (denial of service) or, in more sophisticated scenarios, enabling local privilege escalation by manipulating freed kernel memory. The vulnerability resides in the ALSA AC97 audio driver, so systems with AC97 audio hardware or the relevant kernel module loaded are at risk. The integrity and availability of the affected system are the primary concerns, with confidentiality impact possible if memory corruption is leveraged for privilege escalation (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-71192. The vulnerability was found via code review rather than active exploitation. The EPSS score is very low at approximately 0.024%, reflecting a low probability of near-term exploitation. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation would require local access to a system with the affected AC97 audio driver loaded (Feedly, EUVD).

The Linux kernel maintainers have released patches across all affected stable branches. Users should update to kernel versions 6.1.161, 6.6.121, 6.12.66, 6.18.6, or 6.19-rc5 (or later) as appropriate for their distribution. Major Linux distributions including Ubuntu (USN-8278-1, USN-8289-1, USN-8296-1, USN-8296-2, USN-8278-2, USN-8393-1) and SUSE have issued kernel security updates incorporating this fix. As a temporary workaround, unloading the snd-ac97-codec kernel module on systems that do not require AC97 audio hardware can reduce exposure (Ubuntu Advisory, SUSE Advisory).

The vulnerability received routine coverage from Linux security tracking services and distribution security teams, with Ubuntu and SUSE both issuing kernel update advisories. No notable researcher commentary or significant social media discussion has been identified beyond standard vulnerability database entries and distribution patch announcements (Ubuntu Advisory, SUSE Advisory).