CVE-2026-97418

Received Received - Intake

NULL Pointer Dereference in Linux Kernel ALSA es18xx Driver

Publication date: 2026-09-24

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: es18xx: check control allocation before private data setup snd_es18xx_mixer() creates controls with snd_ctl_new1() and then stores bookkeeping pointers or sets private_free before calling snd_ctl_add(). snd_ctl_new1() can return NULL on allocation failure, so those writes can dereference a NULL control pointer. Check the returned control pointers before using them and return -ENOMEM on allocation failure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-10-03

Generated

2026-10-15

AI Q&A

2026-09-24

EPSS Evaluated

2026-10-13

NVD

CVE-2026-97418

EUVD

EUVD-2026-86031

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a NULL pointer dereference vulnerability in the Linux kernel's ALSA es18xx driver. The function snd_es18xx_mixer() creates controls using snd_ctl_new1() which can return NULL on allocation failure. The code then attempts to write to this NULL pointer before calling snd_ctl_add(), leading to a crash.

Detection Guidance

This vulnerability is specific to the Linux kernel's ALSA es18xx driver and does not have direct network detection methods. To check for affected systems, verify if your kernel version includes the vulnerable code path by examining the driver source or running kernel version checks. Commands like uname -a or checking /proc/version may help identify the kernel version.

Impact Analysis

This vulnerability could cause a system crash or kernel panic if the es18xx driver is used and memory allocation fails. This may lead to denial of service for systems relying on audio functionality.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a low-level kernel memory management issue in the ALSA sound subsystem. It may indirectly impact systems handling sensitive data if exploited to cause denial of service or memory corruption.

Mitigation Strategies

Update your Linux kernel to the latest patched version to resolve this vulnerability. Check your distribution's security advisories for the specific kernel version that includes the fix for CVE-2026-97418.

Hi! I’m here to help you understand CVE-2026-97418. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70