Memory Corruption Vulnerability in Linux Kernel Affects ALSA PCM OSS Component

CVE-2026-64001

What is CVE-2026-64001?

A memory corruption issue was identified in the Linux kernel involving the ALSA PCM OSS component. The problem arises when the function snd_pcm_oss_proc_write() incorrectly links a newly allocated setup entry to the OSS setup list before successfully duplicating the task name. If the process of task-name allocation fails, the function encounters an error that leads to freeing the linked entry, which results in the setup_list pointing to freed memory. This vulnerability allows a subsequent OSS device opening to traverse through the stale list entry in snd_pcm_oss_look_for_setup(), potentially resulting in dereferencing freed memory, which can lead to unpredictable behavior or system crashes. To mitigate this issue, enhancements were made to ensure that task name allocation and setup entry initialization occur prior to publishing the entry to the setup_list, thus maintaining memory integrity.

References