CVE-2026-64001

Analyzed Analyzed - Analysis Complete

Use-After-Free in Linux Kernel ALSA PCM OSS

Publication date: 2026-07-19

Last updated on: 2026-10-02

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: oss: Fix setup list UAF on proc write error snd_pcm_oss_proc_write() links a newly allocated setup entry into the OSS setup list before duplicating the task name. If the task-name allocation fails, the error path frees the already linked entry and leaves setup_list pointing at freed memory. A later OSS device open can then walk the stale list entry in snd_pcm_oss_look_for_setup() and dereference freed memory. Allocate the task name and initialize the setup entry before publishing the entry on setup_list. Also fetch the initial proc read iterator only after taking setup_mutex, so all setup_list traversal follows the same list lifetime rules.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-10-02

Generated

2026-10-09

AI Q&A

2026-07-19

EPSS Evaluated

2026-10-08

NVD

CVE-2026-64001

EUVD

EUVD-2026-45574

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.13 (inc) to 6.18.35 (exc)
linux	linux_kernel	7.1
linux	linux_kernel	From 6.19 (inc) to 7.0.12 (exc)
linux	linux_kernel	From 2.6.17 (inc) to 6.12.93 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This is a use-after-free (UAF) vulnerability in the Linux kernel's ALSA PCM OSS subsystem. It occurs when snd_pcm_oss_proc_write() links a new setup entry into a list before duplicating the task name. If task-name allocation fails, the error path frees the linked entry but leaves the list pointer pointing to freed memory. Later, accessing this stale list entry can cause a use-after-free condition.

Detection Guidance

This vulnerability is specific to the Linux kernel's ALSA PCM OSS component and may not have direct network detection methods. Check kernel logs for memory corruption errors or crashes related to snd_pcm_oss_proc_write. Commands like dmesg | grep -i oss or journalctl -k | grep -i oss may help identify issues.

Impact Analysis

This vulnerability could allow an attacker with local access to trigger a use-after-free condition, potentially leading to system crashes, privilege escalation, or arbitrary code execution. It affects systems using the OSS PCM audio subsystem in the Linux kernel.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a memory corruption issue in the Linux kernel's ALSA PCM OSS component. Compliance impacts would depend on system-specific implementations and compensating controls rather than this vulnerability itself.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for this vulnerability. If immediate patching is not possible, consider disabling the OSS emulation module by adding snd-pcm-oss to a blacklist file in /etc/modprobe.d/.

Hi! I’m here to help you understand CVE-2026-64001. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70