CVE-2026-64484 - Vulnerability Details

- ALSA: es1938: check snd_ctl_new1() return value

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: es1938: check snd_ctl_new1() return value

snd_ctl_new1() can return NULL when memory allocation fails.
snd_es1938_mixer() does not check the return value before dereferencing
the pointer, which can lead to a NULL pointer dereference.

Add a NULL check after snd_ctl_new1() and return -ENOMEM if it fails.

Published: 2026-07-25

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 96cad5bd7d0a176db3fdc06717a41271247336bd
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 6c4efebaf73e217efbd08cdbda805758a7db3680
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 41759affbcfe3d51a32900da9547a1ffd744a85f
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 7531a37720c2545a480fd0fa464978569bf9d6a2
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< af01c48e17a66fa038af210a5c49d6cdefd210bd
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 9e53e99b6fa3cd82992d963cbff58dbbd1df8651
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 1949163dee39e0e4a1468f37dd7302962f6af45a
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 1edd1f02dddd20aeb6066ded41017615766ea42f

Linux

affected

Version	Status	Constraints
`2.6.12`	affected	—
`0`	unaffected	< 2.6.12
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.96`	unaffected	≤ 6.12.*
`6.18.39`	unaffected	≤ 6.18.*
`7.1.4`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,96cad5bd7d0a176db3fdc06717a41271247336bd)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,6c4efebaf73e217efbd08cdbda805758a7db3680)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,41759affbcfe3d51a32900da9547a1ffd744a85f)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,7531a37720c2545a480fd0fa464978569bf9d6a2)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,af01c48e17a66fa038af210a5c49d6cdefd210bd)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,9e53e99b6fa3cd82992d963cbff58dbbd1df8651)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,1949163dee39e0e4a1468f37dd7302962f6af45a)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,1edd1f02dddd20aeb6066ded41017615766ea42f)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.12`	affected	semver	—
`[0,2.6.12)`	unaffected	semver	—
`[5.10.261,5.11.0)`	unaffected	semver	—
`[5.15.212,5.16.0)`	unaffected	semver	—
`[6.1.178,6.2.0)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.96,6.13.0)`	unaffected	semver	—
`[6.18.39,6.19.0)`	unaffected	semver	—
`[7.1.4,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4717-1	linux security update
Debian DLA	DLA-4720-1	linux security update
Debian DLA	DLA-4723-1	linux-6.1 security update
Debian DLA	DLA-4724-1	linux-6.12 new package

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00185.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1949163dee39e0e4a1468f37dd7302962f6af45a
https://git.kernel.org/stable/c/1edd1f02dddd20aeb6066ded41017615766ea42f
https://git.kernel.org/stable/c/41759affbcfe3d51a32900da9547a1ffd744a85f
https://git.kernel.org/stable/c/6c4efebaf73e217efbd08cdbda805758a7db3680
https://git.kernel.org/stable/c/7531a37720c2545a480fd0fa464978569bf9d6a2
https://git.kernel.org/stable/c/96cad5bd7d0a176db3fdc06717a41271247336bd
https://git.kernel.org/stable/c/9e53e99b6fa3cd82992d963cbff58dbbd1df8651
https://git.kernel.org/stable/c/af01c48e17a66fa038af210a5c49d6cdefd210bd
https://lore.kernel.org/linux-cve-announce/2026072548-CVE-2026-64484-adbc@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64484
https://www.cve.org/CVERecord?id=CVE-2026-64484

History

Thu, 30 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026072548-CVE-2026-64484-adbc@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64484 https://www.cve.org/CVERecord?id=CVE-2026-64484

Sun, 26 Jul 2026 01:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Sat, 25 Jul 2026 09:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ALSA: es1938: check snd_ctl_new1() return value snd_ctl_new1() can return NULL when memory allocation fails. snd_es1938_mixer() does not check the return value before dereferencing the pointer, which can lead to a NULL pointer dereference. Add a NULL check after snd_ctl_new1() and return -ENOMEM if it fails.
Title		ALSA: es1938: check snd_ctl_new1() return value
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1949163dee39e0e4a1468f37dd7302962f6af45a https://git.kernel.org/stable/c/1edd1f02dddd20aeb6066ded41017615766ea42f https://git.kernel.org/stable/c/41759affbcfe3d51a32900da9547a1ffd744a85f https://git.kernel.org/stable/c/6c4efebaf73e217efbd08cdbda805758a7db3680 https://git.kernel.org/stable/c/7531a37720c2545a480fd0fa464978569bf9d6a2 https://git.kernel.org/stable/c/96cad5bd7d0a176db3fdc06717a41271247336bd https://git.kernel.org/stable/c/9e53e99b6fa3cd82992d963cbff58dbbd1df8651 https://git.kernel.org/stable/c/af01c48e17a66fa038af210a5c49d6cdefd210bd

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-25T08:51:44.591Z

Updated: 2026-08-17T04:56:31.383Z

Reserved: 2026-07-19T15:36:31.791Z

Link: CVE-2026-64484

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-07-25T10:17:34.083

Modified: 2026-08-17T05:17:54.217

Link: CVE-2026-64484

Redhat

Severity :

Publid Date: 2026-07-25T00:00:00Z

Links: CVE-2026-64484 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-03T18:45:17Z

Weaknesses

CWE-476
NULL Pointer Dereference

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object