CVE-2026-64134
Received Received - Intake

NULL Pointer Dereference in Linux Kernel ALSA PCM Subsystem

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Don't setup bogus iov_iter for silencing At transition to the iov_iter for PCM data transfer, we blindly applied the iov_iter setup also for silencing (i.e. data = NULL), and it leads to a calculation of bogus iov_iter. Fortunately this didn't cause troubles on most of architectures but it goes wrong on RISC-V now, causing a NULL dereference. Handle the NULL data case to treat the silencing in interleaved_copy() for addressing the bug above. noninterleaved_copy() has already the NULL data handling, so it doesn't need changes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64134
EUVD
EUVD-2026-45819

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a bug in the ALSA PCM subsystem where an incorrect iov_iter setup during data transfer leads to a NULL dereference on RISC-V architectures. The issue occurs when silencing audio (data=NULL) and causes a crash due to improper handling.

Detection Guidance

This vulnerability is specific to the Linux kernel and relates to a NULL dereference issue in the ALSA PCM subsystem. Detection requires checking the kernel version and verifying if the vulnerable code path is present. Use uname -a to check your kernel version and grep for the affected function in the kernel source.

Impact Analysis

If you use a Linux system with RISC-V architecture, this vulnerability could cause a kernel crash (NULL dereference) when audio operations involve silencing. Most other architectures are unaffected, but systems using RISC-V may experience system instability or denial of service.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel issue related to PCM data handling that causes a NULL dereference on RISC-V architectures. No evidence suggests it impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this issue. If an update is not immediately available, consider disabling ALSA PCM functionality temporarily or restricting access to audio devices until the patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64134. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart