CVE-2026-64488
Received Received - Intake

NULL Pointer Dereference in Linux Kernel ALSA AOA Subsystem

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: aoa: check snd_ctl_new1() return value snd_ctl_new1() can return NULL when memory allocation fails. In layout.c, the function does not check the return value before dereferencing ctl->id.name or passing to aoa_snd_ctl_add(), which can lead to a NULL pointer dereference. Add NULL checks after snd_ctl_new1() calls and return early if any fails.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64488
EUVD
EUVD-2026-48832

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a NULL pointer dereference vulnerability in the Linux kernel's ALSA (Advanced Linux Sound Architecture) AOA (Apple Onboard Audio) driver. It occurs when snd_ctl_new1() fails to allocate memory and returns NULL, but the code does not check this return value before using the pointer. This leads to a crash when the code tries to access ctl->id.name or pass the NULL pointer to aoa_snd_ctl_add().

Detection Guidance

This vulnerability is specific to the Linux kernel's ALSA AOA subsystem and may not have direct network detection methods. Check kernel logs for NULL pointer dereference errors in ALSA or AOA-related modules using dmesg or journalctl commands.

Impact Analysis

If exploited, this vulnerability could cause a system crash or kernel panic, leading to denial of service. It may also potentially allow local attackers to escalate privileges depending on the kernel configuration and environment.

Mitigation Strategies

Update your Linux kernel to the latest patched version. If immediate patching is not possible, disable the ALSA AOA subsystem by blacklisting the aoa kernel module to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64488. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart