Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: ALSA: gus: check snd_ctl_new1() return value snd_ctl_new1() can return NULL when… (CVE-2026-64482)
A vulnerability in the Linux kernel ALSA gus driver was fixed by adding a NULL check after the snd_ctl_new1() call. The function snd_ctl_new1() can return NULL on memory allocation failure, and without this check, snd_gf1_pcm_volume_control() dereferences a NULL pointer, leading to a potential NULL pointer dereference. This issue has been resolved in updated Linux kernel versions.
AI Analysis
Technical Summary
The Linux kernel ALSA gus driver had a vulnerability where snd_ctl_new1() could return NULL if memory allocation failed. The snd_gf1_pcm_volume_control() function did not check this return value before dereferencing kctl->id.index, which could cause a NULL pointer dereference. The fix involves adding a NULL check after snd_ctl_new1() and returning -ENOMEM if the allocation fails. This vulnerability affects multiple versions of the linux-hwe-edge kernel prior to 7.0.0-1012.12~24.04.1 and related versions. The patch is available and included in updated kernel packages.
Potential Impact
If unpatched, the vulnerability could lead to a NULL pointer dereference in the ALSA gus driver, potentially causing a kernel crash or denial of service. There is no indication of remote exploitation or privilege escalation from this specific issue. The severity is assessed as medium.
Mitigation Recommendations
A patch is available and should be applied by updating to the fixed Linux kernel versions (>=7.0.0-1012.12~24.04.1 and related). After updating, a system reboot is required. No additional mitigation steps are necessary as the issue is resolved by the official fix.
Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: ALSA: gus: check snd_ctl_new1() return value snd_ctl_new1() can return NULL when… (CVE-2026-64482)
Description
A vulnerability in the Linux kernel ALSA gus driver was fixed by adding a NULL check after the snd_ctl_new1() call. The function snd_ctl_new1() can return NULL on memory allocation failure, and without this check, snd_gf1_pcm_volume_control() dereferences a NULL pointer, leading to a potential NULL pointer dereference. This issue has been resolved in updated Linux kernel versions.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel ALSA gus driver had a vulnerability where snd_ctl_new1() could return NULL if memory allocation failed. The snd_gf1_pcm_volume_control() function did not check this return value before dereferencing kctl->id.index, which could cause a NULL pointer dereference. The fix involves adding a NULL check after snd_ctl_new1() and returning -ENOMEM if the allocation fails. This vulnerability affects multiple versions of the linux-hwe-edge kernel prior to 7.0.0-1012.12~24.04.1 and related versions. The patch is available and included in updated kernel packages.
Potential Impact
If unpatched, the vulnerability could lead to a NULL pointer dereference in the ALSA gus driver, potentially causing a kernel crash or denial of service. There is no indication of remote exploitation or privilege escalation from this specific issue. The severity is assessed as medium.
Mitigation Recommendations
A patch is available and should be applied by updating to the fixed Linux kernel versions (>=7.0.0-1012.12~24.04.1 and related). After updating, a system reboot is required. No additional mitigation steps are necessary as the issue is resolved by the official fix.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-6ch7-9774-5q3m
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64482"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a6542079c2644c7f8082709
Added to database: 07/25/2026, 23:08:55 UTC
Last enriched: 09/07/2026, 17:49:31 UTC
Last updated: 09/07/2026, 17:49:31 UTC
Views: 34
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.