Security readout for executives and security teams
Plain-English summary
A Linux audio driver cleanup error can free the same memory twice after an allocation failure. A successful trigger could corrupt kernel memory, potentially causing a crash or broader system compromise. The supplied CVSS score is 7.8, but exposure depends on whether the SMA1307 driver and vulnerable code path are present.
Executive priority
Treat this as a high-priority kernel maintenance issue on systems using the affected audio driver, especially multi-user or untrusted-workload hosts. It is not supported as an internet-wide emergency because exploitation is local and no active exploitation evidence is supplied. Establish hardware and driver reachability before accelerating disruptive fleet-wide changes.
Technical view
In the ASoC SMA1307 driver, mode_set entries allocated through devm_kzalloc() were manually released with kfree() during an error path. Because device-managed resources are released again by devres, this can cause a kernel double free. The documented correction removes the manual cleanup loop and delegates release to devres.
Likely exposure
The supplied record marks Linux 6.15, 6.18.21, 6.19.11, and 7.0 as affected, alongside an ambiguous “0” entry. Practical exposure requires the vulnerable SMA1307 audio-driver code and its allocation-failure path. Confirm exact distribution kernel status with the relevant vendor because backports can change version-based conclusions.
Exploitation context
The CVSS vector describes a local, low-privileged attack requiring no user interaction, with potentially high confidentiality, integrity, and availability impact. The bundle does not establish remote reachability, public exploitation, or active exploitation. It explicitly reports that the CVE is not in KEV.
Researcher notes
The vulnerable behavior is confined to an allocation-failure cleanup path in sma1307_setting_loaded(). Exploitability beyond denial of service is asserted by the CVSS impacts but not demonstrated in the supplied sources. The version data contains duplicates and an ambiguous “0”; use stable commits and distribution backport records for authoritative exposure mapping.
Mitigation direction
- Apply the appropriate vendor kernel update containing the SMA1307 double-free correction.
- Prioritize systems using the SMA1307 ASoC driver or matching audio hardware.
- Consult distribution advisories to identify backported fixes and corrected package versions.
- If updates are delayed, assess whether the affected driver can be safely disabled under vendor guidance.
Validation and detection
- Inventory running kernel and distribution package versions across Linux systems.
- Determine whether the SMA1307 driver is built, installed, loaded, or required.
- Compare vendor package changelogs against CVE-2026-31475 and the referenced stable commits.
- After updating, verify the running kernel contains the applicable correction.
- Monitor kernel logs and crash telemetry for memory-corruption or SMA1307-related failures.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-31475 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/d472d1a52985211b92883bb64bbe710b45980190CVE reference, Linux
- https://git.kernel.org/stable/c/1a82c3272626db9006f4c2cad3adf2916417aed6CVE reference, Linux
- https://git.kernel.org/stable/c/fe757092d2329c397ecb32f2bf68a5b1c4bd9193CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.