Not yet scoredPublished Jul 25, 2026

CVE-2026-64486ALSA: cmipci: check snd_ctl_new1() return value

Updated under an hour ago (Oct 27, 2026, 4:50 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ALSA: cmipci: check snd_ctl_new1() return value snd_ctl_new1() can return NULL when memory allocation fails. snd_cmipci_spdif_controls() does not check the return value before dereferencing kctl->id.device, which can lead to a NULL pointer dereference. Add NULL checks after snd_ctl_new1() calls and return -ENOMEM if any fails.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Aug 17, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 3454490e0396191f8f9c215fccf5deef76abffb5 before b44888c33c4f11277d0e5e023338f2740232a4ed; from f2f312ad88c68a7f4a7789b9269ae33af3c7c7e9 before 8825a06bfa7932a7a74dec01669d405df0b47286; from f2f312ad88c68a7f4a7789b9269ae33af3c7c7e9 before 4dd5b0b1a52a8d6e59a3f217204817228ce0238b; from f2f312ad88c68a7f4a7789b9269ae33af3c7c7e9 before af2b009b773bc42995546507963e5e78970dc3ed; from f2f312ad88c68a7f4a7789b9269ae33af3c7c7e9 before 67e9ea92cd598cba1783ff701553c776a6cedee9; from f2f312ad88c68a7f4a7789b9269ae33af3c7c7e9 before c205bd1b28fb7e5f1061a4e78813fad7d315cb3e; 7bf12707fa3db4c14fbe8ab93efb421d8ca93bf8; from 6.1.34 before 6.1.178; and 1 more ranges	CNA record

References

References

https://git.kernel.org/stable/c/b44888c33c4f11277d0e5e023338f2740232a4ed
https://git.kernel.org/stable/c/8825a06bfa7932a7a74dec01669d405df0b47286
https://git.kernel.org/stable/c/4dd5b0b1a52a8d6e59a3f217204817228ce0238b
https://git.kernel.org/stable/c/af2b009b773bc42995546507963e5e78970dc3ed
https://git.kernel.org/stable/c/67e9ea92cd598cba1783ff701553c776a6cedee9
https://git.kernel.org/stable/c/c205bd1b28fb7e5f1061a4e78813fad7d315cb3e

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.