CVE-2026-56109

Name of the Vulnerable Software and Affected Versions ALSA library versions prior to 1.2.16.1

Description A double-free issue exists in the parse def() function within src/conf.c. This occurs when the system parses nested compound or array configuration blocks and fails to check return values before proceeding. Consequently, the snd config delete() function is called twice on the same already-freed node, which can lead to memory corruption, a NULL-pointer write, or an invalid memory read if an attacker provides maliciously crafted ALSA configuration text.

Recommendations Update ALSA library to version 1.2.16.1.