Amazon Linux 2023 Security Advisory: ALAS2023-2026-2082
Advisory Released Date: 2026-08-31
Advisory Updated Date: 2026-08-31
Severity:
Medium
Issue Overview:
The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory by supplying maliciously crafted ALSA configuration text. When parsing nested compound or array configuration blocks, parse_def() fails to check return values before continuing, causing snd_config_delete() to be called twice on the same already-freed node, resulting in a NULL-pointer write or invalid memory read. (CVE-2026-56109)
Affected Packages:
alsa-lib
Issue Correction:
Run dnf update alsa-lib --releasever 2023.12.20260831 or dnf update --advisory ALAS2023-2026-2082 --releasever 2023.12.20260831 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
New Packages:
aarch64:
alsa-lib-debugsource-1.2.7.2-1.amzn2023.0.4.aarch64
alsa-lib-debuginfo-1.2.7.2-1.amzn2023.0.4.aarch64
alsa-lib-1.2.7.2-1.amzn2023.0.4.aarch64
alsa-lib-devel-1.2.7.2-1.amzn2023.0.4.aarch64
noarch:
alsa-topology-1.2.7.2-1.amzn2023.0.4.noarch
alsa-ucm-1.2.7.2-1.amzn2023.0.4.noarch
src:
alsa-lib-1.2.7.2-1.amzn2023.0.4.src
x86_64:
alsa-lib-debuginfo-1.2.7.2-1.amzn2023.0.4.x86_64
alsa-lib-debugsource-1.2.7.2-1.amzn2023.0.4.x86_64
alsa-lib-1.2.7.2-1.amzn2023.0.4.x86_64
alsa-lib-devel-1.2.7.2-1.amzn2023.0.4.x86_64