In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Don't setup bogus iov_iter for silencing At transition to the… (CVE-2026-64134)
In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Don't setup bogus iov_iter for silencing At transition to the iov_iter for PCM data transfer, we blindly applied the iov_iter setup also for silencing (i.e. data = NULL), and it leads to a calculation of bogus iov_iter. Fortunately this didn't cause troubles on most of architectures but it goes wrong on RISC-V now, causing a NULL dereference. Handle the NULL data case to treat the silencing in interleaved_copy() for addressing the bug above. noninterleaved_copy() has already the NULL data handling, so it doesn't need changes.
AI Analysis
Technical Summary
The Linux kernel ALSA PCM component previously applied iov_iter setup blindly even when silencing (data = NULL), resulting in a bogus iov_iter calculation. While most architectures were unaffected, RISC-V systems experienced a NULL dereference due to this. The fix involves handling the NULL data case correctly in interleaved_copy(), preventing the invalid iov_iter setup and subsequent crash. noninterleaved_copy() was already handling this case properly and required no changes.
Potential Impact
On affected systems, specifically RISC-V architectures, this vulnerability could cause a kernel NULL pointer dereference leading to a system crash or denial of service during audio PCM silencing operations. There is no indication of privilege escalation or code execution. The impact is limited to stability and availability on affected hardware.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to properly handle NULL data in the ALSA PCM iov_iter setup for silencing. Users should apply the official kernel updates that include this patch once available. Patch status is not yet confirmed in this data; check the vendor or Linux kernel advisories for current remediation guidance.
In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Don't setup bogus iov_iter for silencing At transition to the… (CVE-2026-64134)
Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Don't setup bogus iov_iter for silencing At transition to the iov_iter for PCM data transfer, we blindly applied the iov_iter setup also for silencing (i.e. data = NULL), and it leads to a calculation of bogus iov_iter. Fortunately this didn't cause troubles on most of architectures but it goes wrong on RISC-V now, causing a NULL dereference. Handle the NULL data case to treat the silencing in interleaved_copy() for addressing the bug above. noninterleaved_copy() has already the NULL data handling, so it doesn't need changes.
CVSS v3.1
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel ALSA PCM component previously applied iov_iter setup blindly even when silencing (data = NULL), resulting in a bogus iov_iter calculation. While most architectures were unaffected, RISC-V systems experienced a NULL dereference due to this. The fix involves handling the NULL data case correctly in interleaved_copy(), preventing the invalid iov_iter setup and subsequent crash. noninterleaved_copy() was already handling this case properly and required no changes.
Potential Impact
On affected systems, specifically RISC-V architectures, this vulnerability could cause a kernel NULL pointer dereference leading to a system crash or denial of service during audio PCM silencing operations. There is no indication of privilege escalation or code execution. The impact is limited to stability and availability on affected hardware.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to properly handle NULL data in the ALSA PCM iov_iter setup for silencing. Users should apply the official kernel updates that include this patch once available. Patch status is not yet confirmed in this data; check the vendor or Linux kernel advisories for current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-g8p3-wvvx-m6mf
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64134"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a5d27a82a4a8d598912aee4
Added to database: 07/19/2026, 19:38:16 UTC
Last enriched: 07/19/2026, 19:45:06 UTC
Last updated: 07/20/2026, 19:41:21 UTC
Views: 14
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.