CVE-2026-64001 is a use-after-free vulnerability in the Linux kernel ALSA pcm oss component. The function snd_pcm_oss_proc_write() improperly links a newly allocated setup entry into the OSS setup list before duplicating the task name. If the task-name allocation fails, the already linked entry is freed but the list pointer remains, causing a stale pointer to freed memory. Subsequent OSS device opens can traverse this stale list entry and dereference freed memory, potentially leading to undefined behavior or kernel crashes. The patch corrects this by allocating and initializing the setup entry completely before publishing it on the setup list and by adjusting locking to ensure consistent list lifetime rules during traversal.

The vulnerability can lead to use-after-free conditions in kernel memory, which may cause kernel crashes or undefined behavior. No specific exploitation details or impacts such as privilege escalation or code execution are provided. There are no known exploits in the wild at this time.

A fix for this vulnerability has been implemented in the Linux kernel. Users should update to the patched kernel version once available from their distribution or vendor. Since this is not a cloud service, remediation depends on applying the official kernel update. Patch status is not explicitly confirmed in the provided data; check the vendor or distribution advisory for the exact fixed version and update instructions.