Cloudanix VulnDB

CVE-2026-64134

High · 7.8

CVSS

7.8

EPSS

0.1%

Published

Jul 19, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A bug in the Linux kernel's sound system can cause computers using certain processors to crash when handling audio silence operations.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Improper handling of NULL data pointer during iov_iter setup in ALSA PCM interleaved_copy() leads to invalid iterator calculation and subsequent NULL pointer dereference on RISC-V during PCM silencing operations.

Why it matters to the business

Local users on affected Linux systems, particularly RISC-V architectures, can trigger kernel crashes resulting in denial of service; low exploitation likelihood reduces immediate operational risk but still requires patching to maintain stability.

How an attack unfolds

A local attacker with access to audio subsystem triggers PCM operations that invoke silencing paths, causing the kernel to dereference an invalid pointer during iov_iter construction in the ALSA PCM code.

How to fix it

Update to a Linux kernel version containing the fix for handling NULL data in interleaved_copy(); apply the upstream ALSA PCM patch that adds explicit NULL checks before iov_iter setup.

How to confirm the fix worked

Verify kernel source contains NULL data handling in sound/core/pcm_lib.c interleaved_copy(); confirm no crash occurs during PCM silence operations on RISC-V hardware; review commit logs for the ALSA silencing fix.

Typical attack path

  1. Obtain local user access on target Linux system
  2. Interact with ALSA PCM device to initiate data transfer or silence operation
  3. Trigger interleaved_copy() path with NULL data pointer
  4. Cause NULL dereference leading to kernel panic

How to detect it

Review kernel logs for NULL pointer dereference oops in ALSA PCM code paths around sound/core/pcm_lib.c; correlate with user-space processes performing audio output or silence operations.

What your security team should do

  • Prioritize kernel updates on RISC-V deployments within standard patch cycles given low EPSS and absence from KEV
  • Monitor for future EPSS increases or new exploit reports
  • Test audio subsystem stability post-update in lab environments before broad rollout

The record

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Don't setup bogus iov_iter for silencing At transition to the iov_iter for PCM data transfer, we blindly applied the iov_iter setup also for silencing (i.e. data = NULL), and it leads to a calculation of bogus iov_iter. Fortunately this didn't cause troubles on most of architectures but it goes wrong on RISC-V now, causing a NULL dereference. Handle the NULL data case to treat the silencing in interleaved_copy() for addressing the bug above. noninterleaved_copy() has already the NULL data handling, so it doesn't need changes.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities