Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Don't setup bogus iov_iter for silencing At transition to the… (CVE-2026-64134)

The Linux kernel ALSA PCM subsystem had a vulnerability where the iov_iter setup was blindly applied for silencing (NULL data), resulting in a bogus iov_iter calculation. While most architectures were unaffected, RISC-V systems experienced a NULL pointer dereference causing a crash. The fix involves handling the NULL data case properly in interleaved_copy(), preventing the NULL dereference. This vulnerability is tracked as CVE-2026-64134 and affects numerous Linux kernel versions prior to 7.0.0-28.28 and specific other versions enumerated. The vendor advisory confirms a patch is available and recommends updating to fixed kernel versions.

On affected RISC-V systems, this vulnerability can cause a NULL pointer dereference leading to a kernel crash and denial of service. The impact includes potential system instability or downtime. There is no indication of remote exploitation or privilege escalation from this specific flaw. The CVSS score is 7.8, indicating a high impact on confidentiality, integrity, and availability, but the attack vector is local with low complexity and privileges required.

A patch is available and should be applied by updating the Linux kernel to the fixed versions as provided by the vendor. After updating, a system reboot is required to apply the changes. The vendor advisory emphasizes recompiling and reinstalling third-party kernel modules due to an ABI change. No additional mitigation steps are indicated beyond applying the official fix.