A memory management flaw in the Linux kernel’s ASoC audio subsystem allows a double free of device‑managed data allocated by devm_kzalloc(). The original cleanup loop incorrectly called kfree(), which can trigger a second free when the device’s resource allocator later releases the same memory. This vulnerability may cause a crash of the audio driver or, in a worst case scenario, arbitrary code execution with kernel‑level privileges. The description states that the bug was fixed by removing the manual kfree loop and delegating cleanup to devres.*

The vulnerability exists in the Linux kernel source tree. No specific kernel release or version is enumerated in the advisory; it applies to any kernel configuration that includes the sma1307 audio driver prior to the referenced commit that deletes the manual cleanup loop.

Because the change is internal to the kernel, exploitation requires that an attacker can trigger the audio driver’s error path, likely through crafted audio data or device interactions. No EPSS score is supplied, and the issue is not listed in the KEV catalog, but double‑free bugs in the kernel are generally considered high‑severity. Attackers with local privileges or those able to load the driver can potentially exploit it, making it a high‑risk vulnerability if a patched kernel is not in use.