CVE-2026-64134

Analyzed Analyzed - Analysis Complete

NULL Pointer Dereference in Linux Kernel ALSA PCM Subsystem

Publication date: 2026-07-19

Last updated on: 2026-08-13

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Don't setup bogus iov_iter for silencing At transition to the iov_iter for PCM data transfer, we blindly applied the iov_iter setup also for silencing (i.e. data = NULL), and it leads to a calculation of bogus iov_iter. Fortunately this didn't cause troubles on most of architectures but it goes wrong on RISC-V now, causing a NULL dereference. Handle the NULL data case to treat the silencing in interleaved_copy() for addressing the bug above. noninterleaved_copy() has already the NULL data handling, so it doesn't need changes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-08-13

Generated

2026-08-30

AI Q&A

2026-07-19

EPSS Evaluated

2026-08-28

NVD

CVE-2026-64134

EUVD

EUVD-2026-45819

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.7 (inc) to 6.12.92 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.34 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.11 (exc)
linux	linux_kernel	From 6.6 (inc) to 6.6.142 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a bug in the ALSA PCM subsystem where an incorrect iov_iter setup during data transfer leads to a NULL dereference on RISC-V architectures. The issue occurs when silencing audio (data=NULL) and causes a crash due to improper handling.

Detection Guidance

This vulnerability is specific to the Linux kernel and relates to a NULL dereference issue in the ALSA PCM subsystem. Detection requires checking the kernel version and verifying if the vulnerable code path is present. Use uname -a to check your kernel version and grep for the affected function in the kernel source.

Impact Analysis

If you use a Linux system with RISC-V architecture, this vulnerability could cause a kernel crash (NULL dereference) when audio operations involve silencing. Most other architectures are unaffected, but systems using RISC-V may experience system instability or denial of service.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel issue related to PCM data handling that causes a NULL dereference on RISC-V architectures. No evidence suggests it impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this issue. If an update is not immediately available, consider disabling ALSA PCM functionality temporarily or restricting access to audio devices until the patch is applied.

Hi! I’m here to help you understand CVE-2026-64134. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70