Memory Management Vulnerability in Linux Kernel ALSA ymfpci

CVE-2026-64489

What is CVE-2026-64489?

A memory management vulnerability exists within the ALSA ymfpci component of the Linux Kernel, where the snd_ctl_new1() function may return NULL during memory allocation failures. If this return value is not properly validated, it can lead to a NULL pointer dereference in snd_ymfpci_create_spdif_controls(), destabilizing the system. To mitigate this issue, NULL checks have been implemented to ensure that any memory allocation failure is handled gracefully, returning -ENOMEM if needed.

References