CVE-2026-56109 describes a double-free vulnerability in the Advanced Linux Sound Architecture (ALSA) library versions prior to 1.2.16.1. The issue is located in the parse_def() function in src/conf.c, which improperly handles return values when parsing nested compound or array configuration blocks. This causes the snd_config_delete() function to be invoked twice on the same already-freed node, leading to memory corruption including NULL-pointer writes or invalid memory reads. The vulnerability has a CVSS 4.0 score of 7.0, indicating high severity, with local attack vector and no required privileges or user interaction.

Successful exploitation can cause memory corruption in the ALSA library, potentially leading to application crashes or undefined behavior. The vulnerability arises from a double-free condition that may result in NULL-pointer writes or invalid memory reads. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor the alsa-project advisories for updates addressing this vulnerability. Until a fix is available, avoid processing untrusted ALSA configuration files.