Skip to main content
CVE-2026-64488VulnerabilityPublished 07/25/2026

In the Linux kernel, the following vulnerability has been resolved: ALSA: aoa: check snd_ctl_new1() return value…

Source GCVE Database

0

Not known to be exploited.

Data as of 10/25/2026, 04:40:13 UTC

Severity
Medium

No CVSS score from NVD or the CNA

Exploitation

Not in CISA KEV, no exploitation reported

EPSS
0.1% chance of exploitation in 30 days – higher than 7% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

What to do

AI-suggested

A fix has been implemented in the Linux kernel to add NULL checks after snd_ctl_new1() calls. Users should update to a kernel version that includes this patch once available.

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: aoa: check snd_ctl_new1() return value snd_ctl_new1() can return NULL when memory allocation fails. In layout.c, the function does not check the return value before dereferencing ctl->id.name or passing to aoa_snd_ctl_add(), which can lead to a NULL pointer dereference. Add NULL checks after snd_ctl_new1() calls and return early if any fails.

Impact

This vulnerability can cause a NULL pointer dereference in the ALSA aoa driver, potentially leading to a kernel crash or denial of service. There is no indication of privilege escalation or code execution impact. No known exploits in the wild have been reported.

References

Community reviews

Loading reviews…