CVE-2026-64480

What it actually does

This is a Linux kernel denial-of-service vulnerability in the ALSA ice1712 family of audio drivers. The affected driver code calls snd_ctl_new1(), which can return NULL when kernel memory allocation fails, and then dereferences the returned pointer without validating it. If the allocation failure is triggered during affected driver initialization or control creation paths, the kernel can hit a NULL pointer dereference, causing an oops, kernel panic, driver failure, or system instability depending on kernel panic settings and workload state. The issue affects reliability rather than confidentiality or integrity; there is no indication of remote code execution or privilege escalation from the available information.

Why it matters to the business

Successful exploitation can crash or destabilize Linux systems that load the affected ALSA ice1712-related drivers, resulting in service interruption, reboot, or loss of availability. The practical risk is constrained because exploitation appears to require local conditions, a relevant audio driver/device or module path, and memory allocation failure conditions. It is not listed in CISA KEV, is not reported as ransomware-used, has very low EPSS, and has no known exploit maturity, so remediation should be handled through normal kernel patching unless affected systems are availability-critical or expose untrusted local users.

How an attack unfolds

An attacker with local access or another way to influence kernel memory pressure targets a Linux system that can load or initialize the affected ALSA ice1712-related audio driver code. The attacker attempts to create low-memory conditions at the time the driver allocates ALSA control structures through snd_ctl_new1(). If the allocation returns NULL, vulnerable driver paths in ice1712.c, ice1724.c, or aureon.c may dereference the NULL pointer instead of returning an allocation error. The result is a kernel NULL pointer dereference, typically producing kernel log errors and potentially causing an oops, panic, reboot, or loss of audio subsystem functionality. There is currently no public indication of active exploitation, ransomware use, or named threat actor activity for this issue.

How to fix it

Apply a Linux kernel update from the operating system or appliance vendor that includes the ALSA ice1712 fix adding NULL checks after snd_ctl_new1() calls and returning -ENOMEM on allocation failure. Because fixed versions were not provided in the input, rely on vendor advisories, distro security trackers, and kernel changelogs for the exact patched package build. Where immediate patching is not possible, reduce exposure by preventing affected modules from loading if the hardware/functionality is not required, for example by blacklisting relevant ALSA ice1712-family modules through standard Linux module configuration and rebuilding initramfs where applicable. Also restrict local shell access to trusted users and monitor systems where untrusted users can induce memory pressure. Reboot into the patched kernel after installation; merely installing kernel packages is not sufficient if the running kernel remains vulnerable.

How to confirm the fix worked

Confirm that systems are running a vendor kernel build containing the ALSA ice1712 snd_ctl_new1() NULL-check fix, not just that the package is installed. Validate with uname -a, package manager kernel version/build metadata, and vendor security advisory references. If source or debug symbols are available, confirm the affected driver paths check the snd_ctl_new1() return value and return -ENOMEM on failure. Check whether relevant modules are present or loaded using lsmod and modinfo for ice1712-family ALSA drivers. If mitigation by blacklisting is used, confirm the module is not loaded after reboot and is blocked by modprobe configuration. Review kernel logs after patching or mitigation to ensure there are no recurring NULL pointer dereference, oops, or panic messages associated with ALSA ice1712, ice1724, aureon, or snd_ctl_new1().

Typical attack path

1. Identify a Linux system where the affected ALSA ice1712-related driver can be loaded or initialized.
2. Obtain local execution capability or otherwise influence the timing of driver initialization and system memory pressure.
3. Force or wait for memory allocation failure during snd_ctl_new1() calls in the affected driver path.
4. Trigger driver initialization or ALSA control creation for the affected hardware/module path.
5. Cause the unchecked NULL return value to be dereferenced, resulting in a kernel oops, panic, reboot, or degraded system availability.

How to detect it

To determine whether this was already exploited or triggered accidentally, review kernel, system, and crash logs for NULL pointer dereferences, kernel oopses, panics, or reboots involving ALSA ice1712-family driver code. Useful sources include journalctl -k, /var/log/kern.log, /var/log/messages, /var/log/syslog, persistent systemd journal data, kdump/vmcore records, pstore, and crash dump analysis output. Look for call traces referencing snd_ctl_new1(), snd_ice1712, snd_vt1724, ice1712.c, ice1724.c, aureon.c, or ALSA control creation near the time of a crash. Correlate events with memory pressure indicators such as allocation failures, out-of-memory messages, module load events, modprobe activity, or hardware initialization. Because this is a denial-of-service flaw without known remote exploitation or stable post-exploitation artifacts, detection is primarily based on crash artifacts and kernel log signatures rather than network indicators.

• NULL pointer dereference
• BUG: kernel NULL pointer dereference
• Oops: 0000
• Kernel panic - not syncing
• snd_ctl_new1
• ice1712.c
• ice1724.c
• aureon.c
• snd_ice1712
• snd_vt1724
• ALSA: ice1712
• modprobe snd-ice1712
• modprobe snd-vt1724
• Out of memory
• page allocation failure

What your security team should do

• Inventory Linux systems that run kernels with ALSA sound support and determine whether ice1712-family audio drivers are present or loaded.
• Prioritize patching availability-critical Linux systems and systems allowing untrusted local users, even though current exploitation likelihood is low.
• Deploy vendor-provided kernel updates that include the ALSA ice1712 NULL pointer dereference fix and reboot into the patched kernel.
• If the affected audio functionality is unnecessary, blacklist the affected modules as a compensating control until patching is complete.
• Monitor kernel logs for NULL pointer dereference, kernel oops, panic, or call traces involving snd_ctl_new1, ice1712, ice1724, or aureon.
• Track vendor advisories because exact fixed package versions vary by distribution and no universal fixed version was provided.
• Treat any unexplained reboot or kernel panic involving these driver paths as a potential availability incident and preserve logs for forensic review.