Linux Kernel ALSA Vulnerability in cmipci Module

CVE-2026-64486

What is CVE-2026-64486?

A vulnerability exists in the ALSA cmipci module of the Linux kernel due to improper handling of the return value from the snd_ctl_new1() function. When memory allocation fails, snd_ctl_new1() can return NULL, yet the snd_cmipci_spdif_controls() function does not perform adequate checks on this result before accessing the kctl->id.device member. This oversight can lead to a NULL pointer dereference, potentially causing application crashes or instability within the kernel. The vulnerability has been addressed by introducing necessary null checks and adjustments to the error handling routine.

References