CVE-2026-56109 ALSA Library < 1.2.16.1 Double-Free via parse_def() in conf.c
Attackers can corrupt memory and potentially execute code or cause denial of service by supplying maliciously crafted ALSA configuration text to the library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-56109?
CVE-2026-56109 is a high-severity use after free vulnerability in alsa-project alsa-lib, published on 22 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory by supplying maliciously crafted ALSA configuration text. When parsing nested compound or array configuration blocks, parse_def() fails to check return values before continuing, causing snd_config_delete() to be called twice on the same already-freed node, resulting in a NULL-pointer write or invalid memory read.
Weakness: CWE-415
Which versions are affected by CVE-2026-56109?
Linux distribution packages (9)
alsa SUSE:Linux Enterprise Micro 5.3 | All versions | 1.2.6.1-150400.3.3.1 |
alsa SUSE:Linux Enterprise Micro 5.4 | All versions | 1.2.6.1-150400.3.3.1 |
alsa SUSE:Linux Enterprise Micro 5.5 | All versions | 1.2.8-150500.3.3.1 |
alsa SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 1.2.10-150600.4.3.1 |
alsa SUSE:Linux Enterprise Server 16.0 | All versions | 1.2.14-160000.3.1 |
alsa SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 1.2.14-160000.3.1 |
alsa SUSE:Linux Micro 6.1 | All versions | 1.2.10-slfo.1.1_2.1 |
alsa SUSE:Linux Micro 6.2 | All versions | 1.2.14-160000.3.1 |
alsa openSUSE:Leap 16.0 | All versions | 1.2.14-160000.3.1 |
How do I fix CVE-2026-56109?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-56109 being exploited?
There is no known exploitation of CVE-2026-56109 in the wild and no public exploit code.
Sources
Also known as AZL-90204, BELL-CVE-2026-56109, DEBIAN-CVE-2026-56109, ECHO-00b6-a8a9-0340, GHSA-jfrh-w252-q2h4, MINI-c9hx-vj2q-7822 and 14 more.