CVE-2026-64489
Received Received - Intake

ALSA: NULL Pointer Dereference in ymfpci Driver

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: ymfpci: check snd_ctl_new1() return value snd_ctl_new1() can return NULL when memory allocation fails. snd_ymfpci_create_spdif_controls() does not check the return value before dereferencing kctl->id.device, which can lead to a NULL pointer dereference. Add NULL checks after snd_ctl_new1() calls and return -ENOMEM if any fails.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64489
EUVD
EUVD-2026-48833

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Linux kernel's ALSA ymfpci driver. It occurs when snd_ctl_new1() fails to allocate memory and returns NULL. The function snd_ymfpci_create_spdif_controls() does not check this return value before using kctl->id.device, leading to a potential NULL pointer dereference.

Impact Analysis

This could cause a system crash or denial of service if exploited. An attacker could trigger the NULL pointer dereference to cause kernel instability or unexpected behavior in systems using the affected Linux kernel component.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64489. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart