CVE-2026-64482
Received Received - Intake

NULL Pointer Dereference in Linux Kernel ALSA Subsystem

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: gus: check snd_ctl_new1() return value snd_ctl_new1() can return NULL when memory allocation fails. snd_gf1_pcm_volume_control() does not check the return value before dereferencing kctl->id.index, which can lead to a NULL pointer dereference. Add a NULL check after snd_ctl_new1() and return -ENOMEM if it fails.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-08-14
AI Q&A
2026-07-25
EPSS Evaluated
2026-08-13
NVD
CVE-2026-64482
EUVD
EUVD-2026-48826

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a NULL pointer dereference vulnerability in the Linux kernel's Advanced Linux Sound Architecture (ALSA) subsystem. The issue occurs in the snd_gf1_pcm_volume_control function, which fails to check if snd_ctl_new1() returns NULL due to memory allocation failure. When it dereferences kctl->id.index without validation, it causes a crash.

Detection Guidance

This vulnerability is specific to the Linux kernel's ALSA sound subsystem and may not have direct network detection methods. To check for affected systems, verify if your kernel version includes the vulnerable code path for snd_gf1_pcm_volume_control(). Use commands like 'uname -a' to check kernel version and 'dmesg | grep snd' to inspect sound driver logs for errors.

Impact Analysis

This vulnerability could cause a system crash or kernel panic if an attacker triggers memory allocation failure in the ALSA subsystem. Users may experience sudden system freezes or require a reboot to restore normal operation.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a local kernel memory safety issue that could cause system instability but does not involve data exposure or privacy violations.

Mitigation Strategies

Apply the latest kernel update provided by your Linux distribution to patch the vulnerability. If immediate updates are unavailable, consider disabling the ALSA GUS driver module via 'modprobe -r snd-gus-lib' as a temporary workaround. Monitor kernel security advisories for official patches.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64482. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart