What is CVE-2026-89895?

CVE-2026-89895 is a unscored severity Linux kernel vulnerability, affecting Linux kernel versions from 4.2 onward and patched in 5.10.270, 5.15.221, 6.1.188 and others. CVE-2026-89895 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2026-89895?

CVE-2026-89895 has a CVSS score of pending NVD analysis out of 10, rated awaiting scoring severity.

Is there a patch available for CVE-2026-89895?

Yes, CVE-2026-89895 has been patched. Fixed versions include 5.10.270, 5.15.221, 6.1.188 and others. If you are running Linux kernel 4.2 or later up to the fix versions, apply the relevant patch for your kernel branch.

Is CVE-2026-89895 actively exploited?

CVE-2026-89895 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

CVE-2026-89895

In the Linux kernel, the following vulnerability has been resolved: media: cobalt: Avoid freeing ALSA private data twice snd_cobalt_card_create() stores cobsc in sc->private_data and installs snd_cobalt_card_private_free() as sc->private_free. From that point, snd_card_free(sc) releases cobsc through the ALSA card cleanup path. If cobalt_alsa_init() fails after snd_cobalt_card_create(), the err_exit_free path calls snd_card_free(sc) and then kfree(cobsc). That second free releases the same object again. Remove the explicit kfree(cobsc) and leave ownership with the ALSA card. This issue was found by a static analysis checker and confirmed by manual source review.

Package Linux Kernel

Published 2026-09-16

Last modified 2026-09-16

Patch available

Yes

Affected versions

Linux kernel versions 4.2 and later are affected. Fixed in 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.51, 7.2.5, 7.3-rc1 and their respective stable series.

Affected from

≥ 4.2

Fixed in

✓ 5.10.270 5.10.x ✓ 5.15.221 5.15.x ✓ 6.1.188 6.1.x ✓ 6.6.157 6.6.x ✓ 6.12.110 6.12.x ✓ 6.18.51 6.18.x ✓ 7.2.5 7.2.x ✓ 7.3-rc1

References

8 total

Showing 5 of 8 references View all on NVD

Frequently asked questions

What is CVE-2026-89895?

CVE-2026-89895 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 4.2 onward and has been patched in 5.10.270, 5.15.221, 6.1.188 and others. CVE-2026-89895 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
Is there a patch available for CVE-2026-89895?

Yes. CVE-2026-89895 has been patched. Fixed versions include 5.10.270, 5.15.221, 6.1.188 and others. If you are running Linux kernel 4.2 or later up to the fix versions, apply the relevant patch for your kernel branch.
Is CVE-2026-89895 actively exploited?

No. CVE-2026-89895 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.