CVE-2026-97418: ALSA: es18xx: check control allocation before private data setup
In the Linux kernel, the following vulnerability has been resolved:
ALSA: es18xx: check control allocation before private data setup
sndes18xxmixer() creates controls with sndctlnew1() and then stores bookkeeping pointers or sets privatefree before calling sndctladd(). sndctlnew1() can return NULL on allocation failure, so those writes can dereference a NULL control pointer.
Check the returned control pointers before using them and return -ENOMEM on allocation failure.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In ALSA es18xx mixer control allocation, check each control pointer returned by snd_ctl_new1() before dereferencing or storing bookkeeping/private data, and return -ENOMEM when allocation fails.
Event History
Frequently Asked Questions
Under what condition can this issue be triggered?
It requires snd_ctl_new1() to fail while the es18xx mixer controls are being created. The vulnerable code then accesses the returned control pointer without first checking whether it is NULL.
What is the likely impact of an allocation failure in the affected path?
A failed control allocation can lead to a NULL pointer dereference when bookkeeping pointers or the private_free handler are set. The corrected behavior is to detect the failure and return -ENOMEM.
How can I determine whether my kernel includes the fix?
Check whether the es18xx mixer code verifies each snd_ctl_new1() return value before accessing control fields or passing the control onward. The listed stable kernel references identify commits that implement this check.