Security update for alsa

CVE-2026-56109 is a double-free vulnerability in the ALSA library's parse_def() function. When processing nested configuration blocks, the library attempts to free an already freed memory node, causing memory corruption. This can result in system instability, crashes, or denial of service. The vulnerability affects Red Hat Hardened Images RPMs including alsa-lib-1.2.16.1-2.hum1 and related packages for aarch64 and x86_64 architectures. Red Hat has published an advisory but currently does not provide a fix that meets their criteria for ease of use, applicability, and stability. The vulnerability has a Red Hat CVSS v3 score of 6.8 (medium severity) with local attack vector, low complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and high availability impact.

The vulnerability allows a local attacker to corrupt memory by triggering a double-free condition in ALSA configuration parsing. This can cause system instability, crashes, or denial of service. There is no indication of confidentiality impact, but integrity impact is low and availability impact is high. No known exploits are reported in the wild. The flaw requires local access and crafted ALSA configuration text to exploit.

Currently, no official fix or practical mitigation is available that meets Red Hat's criteria for deployment and stability. Users should monitor Red Hat advisories for updates. Applying the update to the provided RPM versions (alsa-lib-1.2.16.1-2.hum1 and related packages) when a fix becomes available is recommended. Customers with Red Hat Technical Account Managers (TAM) can seek direct guidance. No other mitigations are specified by Red Hat.