CVE-2026-64486 is a vulnerability in Linux Kernel
Published on July 25, 2026
ALSA: cmipci: check snd_ctl_new1() return value
In the Linux kernel, the following vulnerability has been resolved:
ALSA: cmipci: check snd_ctl_new1() return value
snd_ctl_new1() can return NULL when memory allocation fails.
snd_cmipci_spdif_controls() does not check the return value before
dereferencing kctl->id.device, which can lead to a NULL pointer
dereference.
Add NULL checks after snd_ctl_new1() calls and return -ENOMEM if any
fails.
Products Associated with CVE-2026-64486
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 3454490e0396191f8f9c215fccf5deef76abffb5 and below b44888c33c4f11277d0e5e023338f2740232a4ed is affected.
- Version f2f312ad88c68a7f4a7789b9269ae33af3c7c7e9 and below 8825a06bfa7932a7a74dec01669d405df0b47286 is affected.
- Version f2f312ad88c68a7f4a7789b9269ae33af3c7c7e9 and below 4dd5b0b1a52a8d6e59a3f217204817228ce0238b is affected.
- Version f2f312ad88c68a7f4a7789b9269ae33af3c7c7e9 and below af2b009b773bc42995546507963e5e78970dc3ed is affected.
- Version f2f312ad88c68a7f4a7789b9269ae33af3c7c7e9 and below 67e9ea92cd598cba1783ff701553c776a6cedee9 is affected.
- Version f2f312ad88c68a7f4a7789b9269ae33af3c7c7e9 and below c205bd1b28fb7e5f1061a4e78813fad7d315cb3e is affected.
- Version 7bf12707fa3db4c14fbe8ab93efb421d8ca93bf8 is affected.
- Version 6.1.34 and below 6.1.178 is affected.
- Version 6.3.8 and below 6.4 is affected.
- Version 6.4 is affected.
- Before 6.4 is unaffected.
- Version 6.1.178, <= 6.1.* is unaffected.
- Version 6.6.145, <= 6.6.* is unaffected.
- Version 6.12.96, <= 6.12.* is unaffected.
- Version 6.18.39, <= 6.18.* is unaffected.
- Version 7.1.4, <= 7.1.* is unaffected.
- Version 7.2-rc1, <= * is unaffected.