CVE-2026-64488ALSA: aoa: check snd_ctl_new1() return value
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: ALSA: aoa: check snd_ctl_new1() return value snd_ctl_new1() can return NULL when memory allocation fails. In layout.c, the function does not check the return value before dereferencing ctl->id.name or passing to aoa_snd_ctl_add(), which can lead to a NULL pointer dereference. Add NULL checks after snd_ctl_new1() calls and return early if any fails.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from f3d9478b2ce468c3115b02ecae7e975990697f15 before b0154ebc6dc552c389a574b1e221d728e10346e7; from f3d9478b2ce468c3115b02ecae7e975990697f15 before d62624fe256b2d0d13454c78cbfc70ff5d954dc7; from f3d9478b2ce468c3115b02ecae7e975990697f15 before e5e8c4508d95af82f9b4d065f658e5476a8e9bc8; from f3d9478b2ce468c3115b02ecae7e975990697f15 before 2ee9c46fd2dcd529cef18e37636ee12f5c3dbedd; from f3d9478b2ce468c3115b02ecae7e975990697f15 before d73067e2bbf3775a495d9f38e38d0a3cf53ee790; from f3d9478b2ce468c3115b02ecae7e975990697f15 before fd786466889e4a6e6de0f4462bd0068edea63960; from f3d9478b2ce468c3115b02ecae7e975990697f15 before e47f2a341adbac001b6f5d0211b0cd1c1668637b; from f3d9478b2ce468c3115b02ecae7e975990697f15 before 8df560fefe6fed6a20b7e06720eeaeccec349ac0 | CNA record |
References
- https://git.kernel.org/stable/c/b0154ebc6dc552c389a574b1e221d728e10346e7
- https://git.kernel.org/stable/c/d62624fe256b2d0d13454c78cbfc70ff5d954dc7
- https://git.kernel.org/stable/c/e5e8c4508d95af82f9b4d065f658e5476a8e9bc8
- https://git.kernel.org/stable/c/2ee9c46fd2dcd529cef18e37636ee12f5c3dbedd
- https://git.kernel.org/stable/c/d73067e2bbf3775a495d9f38e38d0a3cf53ee790
- https://git.kernel.org/stable/c/fd786466889e4a6e6de0f4462bd0068edea63960
- https://git.kernel.org/stable/c/e47f2a341adbac001b6f5d0211b0cd1c1668637b
- https://git.kernel.org/stable/c/8df560fefe6fed6a20b7e06720eeaeccec349ac0
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.