CVE-2026-64488: ALSA: aoa: check snd_ctl_new1() return value
In the Linux kernel, the following vulnerability has been resolved:
ALSA: aoa: check sndctlnew1() return value
sndctlnew1() can return NULL when memory allocation fails. In layout.c, the function does not check the return value before dereferencing ctl->id.name or passing to aoasndctladd(), which can lead to a NULL pointer dereference.
Add NULL checks after sndctlnew1() calls and return early if any fails.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In layout.c, after each snd_ctl_new1() call, check whether the return value is NULL; if it is NULL, return early instead of dereferencing ctl->id.name or passing the result to aoa_snd_ctl_add().
Linux kernel (ALSA: aoa: layout.c) snd_ctl_new1() return value handling = Add NULL checks after snd_ctl_new1() calls; if NULL, return early
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64488?
The severity of CVE-2026-64488 is rated as risk 17, indicating a significant potential impact.
What type of vulnerability is CVE-2026-64488?
CVE-2026-64488 is classified as a Null Pointer Dereference vulnerability in the Linux kernel.
How do I fix CVE-2026-64488?
To fix CVE-2026-64488, you should update to the latest Linux kernel version that addresses this vulnerability.
Which software is affected by CVE-2026-64488?
CVE-2026-64488 affects the Linux kernel ALSA (Advanced Linux Sound Architecture) aoa driver.
What impact does CVE-2026-64488 have on systems?
CVE-2026-64488 can lead to system instability or crashes due to the risk of dereferencing a null pointer.