CVE-2026-31475: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-31475 is a double free vulnerability in the Linux kernel's ASoC (Audio System on Chip) sma1307 driver, specifically within the sma1307_setting_loaded() function. The flaw arises from incorrect manual kfree() calls on memory allocated via devm_kzalloc() (device-managed resources) in error paths, causing a double free when the device resource manager (devres) later releases the same memory. Affected kernel versions include 6.14.9 through pre-6.15, 6.15.1 through pre-6.18.21, 6.19 through pre-6.19.11, and 7.0 release candidates (rc1–rc7). It was published on April 22, 2026, and carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-415 (Double Free) and CWE-763 (Release of Invalid Pointer or Reference). A prior code change introduced NULL checks and cleanup logic for allocation failures in sma1307_setting_loaded(); however, the cleanup loop incorrectly calls kfree() on mode_set entries that were allocated with devm_kzalloc(). Because devm_kzalloc() registers memory with the kernel's device resource management subsystem (devres), manually freeing it with kfree() in the error path results in a double free when devres performs its own cleanup during device teardown. The fix removes the manual kfree() loop and delegates cleanup entirely to devres (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation of this double free condition can lead to memory corruption, which may result in denial of service (kernel crash/panic) or local privilege escalation. An attacker with low-privileged local access could trigger the vulnerable error path in the sma1307 driver, potentially gaining elevated kernel privileges or causing system instability. Confidentiality, integrity, and availability are all rated as High impact per the CVSS assessment (GitHub Advisory).

No public proof-of-concept exploit is known, and there is no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017% (3rd percentile), indicating a very low probability of near-term exploitation. Exploitation requires local access with low privileges, limiting the attack surface compared to remotely exploitable vulnerabilities (GitHub Advisory).

Patches are available in the Linux kernel stable repository. Affected users should update to the following fixed versions: 6.15 or later (for the 6.14.9–6.15 branch), 6.18.21 or later (for the 6.15.1–6.18 branch), 6.19.11 or later (for the 6.19 branch), or 7.0 (final release, not RC). The fix removes the erroneous manual kfree() loop in the error path of sma1307_setting_loaded(), allowing devres to handle cleanup correctly. As a compensating control, restricting local user access on systems running vulnerable kernel versions with the sma1307 driver can reduce exposure (GitHub Advisory, Red Hat Bugzilla).

Red Hat has tracked this issue via its Product Security team and opened a Bugzilla entry (Bug 2460700) with medium severity and priority. The upstream kernel CVE announcement was referenced via the linux-cve-announce mailing list. No significant broader media coverage or notable researcher commentary has been identified beyond standard kernel security tracking (Red Hat Bugzilla).