CVE-2026-64486
Received Received - Intake

ALSA: cmipci NULL Pointer Dereference in Kernel

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: cmipci: check snd_ctl_new1() return value snd_ctl_new1() can return NULL when memory allocation fails. snd_cmipci_spdif_controls() does not check the return value before dereferencing kctl->id.device, which can lead to a NULL pointer dereference. Add NULL checks after snd_ctl_new1() calls and return -ENOMEM if any fails.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-08-14
AI Q&A
2026-07-25
EPSS Evaluated
2026-08-13
NVD
CVE-2026-64486
EUVD
EUVD-2026-48830

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Linux kernel's ALSA cmipci driver. It occurs when memory allocation fails during a control operation, causing snd_ctl_new1() to return NULL. The code then tries to access kctl->id.device without checking for this NULL value, leading to a NULL pointer dereference and potential system crash.

Detection Guidance

This vulnerability is specific to the Linux kernel's ALSA cmipci driver and involves a NULL pointer dereference due to unchecked snd_ctl_new1() return values. Detection requires checking kernel logs for NULL pointer dereference errors related to the cmipci driver or ALSA subsystem. Commands like dmesg | grep -i 'cmipci\|NULL pointer' or journalctl -k | grep -i 'cmipci\|NULL pointer' may help identify such issues.

Impact Analysis

This vulnerability could cause a system crash or instability if exploited. It may lead to denial of service conditions where the affected system becomes unresponsive or requires a reboot. Users relying on audio functionality through the cmipci driver may experience disruptions.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a local denial-of-service issue in the Linux kernel's ALSA sound subsystem due to a NULL pointer dereference, which does not involve data breaches or unauthorized access.

Mitigation Strategies

Apply the latest kernel update provided by your Linux distribution to patch this vulnerability. If an update is not immediately available, consider disabling the cmipci driver module (snd-cmipci) if not required, using rmmod snd-cmipci. Monitor kernel security advisories for further updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64486. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart