CVE-2026-90119 - Vulnerability Details

- ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup

snd_ice1712_probe() performs multiple initialization steps after
snd_card_new(), but directly returns on failures from later steps
without releasing the ALSA card, causing resource leaks when
probing fails.

Use snd_devm_card_new() together with scope-based cleanup
via __free(snd_card_unref), and clear the card pointer after
successful registration to keep it alive.

Published: 2026-09-17

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The ALSA ice1712 driver in the Linux kernel does not release the ALSA card object if later initialization steps fail during the probe. This results in a kernel memory leak that can grow unchecked if probe failures occur repeatedly, potentially exhausting kernel memory and causing system instability or denial of service.

Affected Systems

All builds of the Linux kernel that include the original ALSA ice1712 driver before the applied fix are impacted. The vendor is Linux, and the specific affected versions are not enumerated in the data.

Risk and Exploitability

The CVSS score is 5.5, indicating moderate severity. The EPSS score is below 1%, indicating a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, and no public exploit has been disclosed. The description indicates the flaw arises during driver initialization; based on this, it is inferred that an attacker would need privileges sufficient to load or unload kernel modules or reboot the system. The risk is moderate because lack of exploitation vectors mitigates immediate danger, yet repeated probe failures could lead to resource exhaustion.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`ca642da4b33d385c5a633287e1c4155f1ea09638`	affected	< c5c7c7b6cfae73c46e4544a9ef08ff89231a670d
`ca642da4b33d385c5a633287e1c4155f1ea09638`	affected	< d8ac49391a1562dc784fc91e810e696284cb647e
`ca642da4b33d385c5a633287e1c4155f1ea09638`	affected	< b15782627b6562f7b6d628f4699316f26340f835
`ca642da4b33d385c5a633287e1c4155f1ea09638`	affected	< 24b399f51812d727dc25d7814c4d7e0cca38201e
`ca642da4b33d385c5a633287e1c4155f1ea09638`	affected	< d736eba9c453fedce664fdf592c8b71ecff1932b

Linux

affected

Version	Status	Constraints
`5.15`	affected	—
`0`	unaffected	< 5.15
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.52`	unaffected	≤ 6.18.*
`7.2.6`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[ca642da4b33d385c5a633287e1c4155f1ea09638,c5c7c7b6cfae73c46e4544a9ef08ff89231a670d)`	affected	code_commit	—
`[ca642da4b33d385c5a633287e1c4155f1ea09638,d8ac49391a1562dc784fc91e810e696284cb647e)`	affected	code_commit	—
`[ca642da4b33d385c5a633287e1c4155f1ea09638,b15782627b6562f7b6d628f4699316f26340f835)`	affected	code_commit	—
`[ca642da4b33d385c5a633287e1c4155f1ea09638,24b399f51812d727dc25d7814c4d7e0cca38201e)`	affected	code_commit	—
`[ca642da4b33d385c5a633287e1c4155f1ea09638,d736eba9c453fedce664fdf592c8b71ecff1932b)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.15`	affected	generic	—
`[0,5.15)`	unaffected	generic	—
`[6.6.157,6.7.0)`	unaffected	semver	—
`[6.12.110,6.13.0)`	unaffected	semver	—
`[6.18.52,6.19.0)`	unaffected	semver	—
`[7.2.6,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply a Linux kernel revision that contains the patch for the ALSA ice1712 driver’s probe cleanup.
If an update cannot be performed immediately, disable or unload the ice1712 driver until a patched kernel is available.
Restrict kernel module loading to trusted users and monitor system logs for probe errors during boot or driver load to detect regressions.

Generated by OpenCVE AI on September 24, 2026 at 03:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.002.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-90119.mbox
https://git.kernel.org/stable/c/24b399f51812d727dc25d7814c4d7e0cca38201e
https://git.kernel.org/stable/c/b15782627b6562f7b6d628f4699316f26340f835
https://git.kernel.org/stable/c/c5c7c7b6cfae73c46e4544a9ef08ff89231a670d
https://git.kernel.org/stable/c/d736eba9c453fedce664fdf592c8b71ecff1932b
https://git.kernel.org/stable/c/d8ac49391a1562dc784fc91e810e696284cb647e
https://nvd.nist.gov/vuln/detail/CVE-2026-90119
https://www.cve.org/CVERecord?id=CVE-2026-90119

History

Thu, 24 Sep 2026 02:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-400

Thu, 24 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-772
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-90119.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-90119 https://www.cve.org/CVERecord?id=CVE-2026-90119
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Sun, 20 Sep 2026 04:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-400

Thu, 17 Sep 2026 16:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup snd_ice1712_probe() performs multiple initialization steps after snd_card_new(), but directly returns on failures from later steps without releasing the ALSA card, causing resource leaks when probing fails. Use snd_devm_card_new() together with scope-based cleanup via __free(snd_card_unref), and clear the card pointer after successful registration to keep it alive.
Title		ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/24b399f51812d727dc25d7814c4d7e0cca38201e https://git.kernel.org/stable/c/b15782627b6562f7b6d628f4699316f26340f835 https://git.kernel.org/stable/c/c5c7c7b6cfae73c46e4544a9ef08ff89231a670d https://git.kernel.org/stable/c/d736eba9c453fedce664fdf592c8b71ecff1932b https://git.kernel.org/stable/c/d8ac49391a1562dc784fc91e810e696284cb647e

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-17T16:06:23.962Z

Updated: 2026-09-17T16:06:23.962Z

Reserved: 2026-09-11T19:38:34.787Z

Link: CVE-2026-90119

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-17T17:17:04.080

Modified: 2026-09-17T17:17:04.080

Link: CVE-2026-90119

Redhat

Severity : Low

Publid Date: 2026-09-17T00:00:00Z

Links: CVE-2026-90119 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-24T03:30:08Z

Weaknesses

CWE-772
Missing Release of Resource after Effective Lifetime

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object