CVE-2023-54308

A flaw was found in the Linux kernel's ALSA ymfpci sound driver. During a previous refactoring commit that removed snd_card_ymfpci_remove(), the snd_card_new() call was not updated to snd_devm_card_new(). This omission means snd_card_free() is never called during module unload, leading to a kernel oops when userspace attempts to access the sound device after module removal.

This affects systems with Yamaha YMF724/740/744/754 PCI sound cards using the ymfpci driver. The crash occurs only after the module is unloaded and a subsequent access attempt is made to the sound device. Standard system operation without module unloading is unaffected, limiting the impact to administrative driver management scenarios.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.