CVE-2026-89944

Name	CVE-2026-89944
Description	In the Linux kernel, the following vulnerability has been resolved: ASoC: hdac_hda: Fix hlink refcount leak on component registration failure hdac_hda_dev_probe() gets the HDA link with snd_hdac_ext_bus_link_get() before registering the ASoC component. If component registration fails, the function returns without dropping the link reference. Always call snd_hdac_ext_bus_link_put() after the registration attempt so the reference taken during probe is balanced on both success and failure.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-6528-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
linux (PTS)	bookworm	6.1.176-1	vulnerable
	bookworm (security)	6.1.187-1	vulnerable
	trixie	6.12.107-1	vulnerable
	trixie (security)	6.12.111-1	fixed
	forky	7.2.8-1	fixed
	sid	7.2.9-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
linux	source	trixie	6.12.111-1		DSA-6528-1
linux	source	(unstable)	7.2.6-1

https://git.kernel.org/linus/6ad4892c4f5cb437a928a02f5b7d37d496aa9268 (7.3-rc1)