Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: ALSA: ymfpci: check snd_ctl_new1() return value snd_ctl_new1() can return NULL… (CVE-2026-64489)
A vulnerability in the Linux kernel's ALSA ymfpci driver was resolved by adding checks for NULL return values from snd_ctl_new1() to prevent NULL pointer dereferences. This flaw could occur when memory allocation fails, leading to a potential kernel crash. The issue affects multiple Linux kernel versions prior to 7.0.0-31.31 and related builds. The vulnerability is part of a broader set of Linux kernel security fixes addressing various subsystems. A patch is available and included in updated Linux kernel packages. Users should update and reboot to apply the fix. No known exploits are reported in the wild.
AI Analysis
Technical Summary
The Linux kernel ALSA ymfpci driver did not check the return value of snd_ctl_new1(), which can return NULL on memory allocation failure. This lack of checking led to a NULL pointer dereference when dereferencing kctl->id.device in snd_ymfpci_create_spdif_controls(). The issue was fixed by adding NULL checks after snd_ctl_new1() calls and returning -ENOMEM if any call fails. This vulnerability affects Linux kernel versions prior to 7.0.0-31.31 and related builds in the linux-hwe-edge package. The fix is included in updated kernel packages released by Ubuntu as part of a broader security update addressing multiple kernel vulnerabilities.
Potential Impact
The vulnerability can cause a NULL pointer dereference in the kernel, potentially leading to a denial of service (kernel crash). There is no evidence of privilege escalation or code execution from this specific flaw. No known exploits are reported in the wild. The impact is limited to system stability and availability.
Mitigation Recommendations
A patch is available and included in updated Linux kernel packages for the affected versions. Users should apply the updates and reboot their systems to ensure the fix is applied. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be required. Follow vendor instructions for updating and rebuilding kernel modules as necessary.
Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: ALSA: ymfpci: check snd_ctl_new1() return value snd_ctl_new1() can return NULL… (CVE-2026-64489)
Description
A vulnerability in the Linux kernel's ALSA ymfpci driver was resolved by adding checks for NULL return values from snd_ctl_new1() to prevent NULL pointer dereferences. This flaw could occur when memory allocation fails, leading to a potential kernel crash. The issue affects multiple Linux kernel versions prior to 7.0.0-31.31 and related builds. The vulnerability is part of a broader set of Linux kernel security fixes addressing various subsystems. A patch is available and included in updated Linux kernel packages. Users should update and reboot to apply the fix. No known exploits are reported in the wild.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel ALSA ymfpci driver did not check the return value of snd_ctl_new1(), which can return NULL on memory allocation failure. This lack of checking led to a NULL pointer dereference when dereferencing kctl->id.device in snd_ymfpci_create_spdif_controls(). The issue was fixed by adding NULL checks after snd_ctl_new1() calls and returning -ENOMEM if any call fails. This vulnerability affects Linux kernel versions prior to 7.0.0-31.31 and related builds in the linux-hwe-edge package. The fix is included in updated kernel packages released by Ubuntu as part of a broader security update addressing multiple kernel vulnerabilities.
Potential Impact
The vulnerability can cause a NULL pointer dereference in the kernel, potentially leading to a denial of service (kernel crash). There is no evidence of privilege escalation or code execution from this specific flaw. No known exploits are reported in the wild. The impact is limited to system stability and availability.
Mitigation Recommendations
A patch is available and included in updated Linux kernel packages for the affected versions. Users should apply the updates and reboot their systems to ensure the fix is applied. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be required. Follow vendor instructions for updating and rebuilding kernel modules as necessary.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-6634-rq92-25wm
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64489"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a6542079c2644c7f80829c2
Added to database: 07/25/2026, 23:08:55 UTC
Last enriched: 09/07/2026, 17:45:24 UTC
Last updated: 09/08/2026, 10:52:11 UTC
Views: 42
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.