CVE-2026-64486

What it actually does

This flaw is a NULL pointer dereference in the Linux kernel ALSA C-Media PCI sound driver. During creation of S/PDIF mixer controls, the driver calls snd_ctl_new1(), which can fail and return NULL under memory pressure. Vulnerable code dereferences the returned control object without checking for NULL, which can cause a kernel oops or panic. The practical impact is denial of service on systems where the affected cmipci ALSA driver is present and exercised; it does not indicate data theft, privilege escalation, or remote code execution based on the available information.

Why it matters to the business

Affected Linux systems using the C-Media PCI audio driver could crash or become unstable if the vulnerable code path is triggered, causing service interruption, user downtime, or loss of availability for appliances, workstations, embedded devices, or servers that include this hardware or load the driver. The risk is lower than internet-facing remote vulnerabilities because exploitation appears to depend on local device/driver conditions and memory allocation failure, EPSS is low, it is not in CISA KEV, and there is no known public exploit maturity reported.

How an attack unfolds

An attacker would need a system where the vulnerable Linux kernel includes and can load the ALSA cmipci driver, typically because compatible C-Media PCI audio hardware is present or the module can be initialized. The attacker then attempts to make the relevant driver initialization/control creation path run while memory allocation for snd_ctl_new1() fails. If the allocation returns NULL, the vulnerable function snd_cmipci_spdif_controls() dereferences the missing control object, potentially causing a kernel oops or panic. In a default configuration this is more likely to be a local denial-of-service condition than a remotely exploitable issue, and reliable exploitation may require control over local resource pressure, driver loading, or device initialization timing.

How to fix it

Update the Linux kernel to a vendor release that includes the upstream ALSA cmipci fix adding NULL checks after snd_ctl_new1() and returning -ENOMEM on allocation failure. Because exact affected package names and fixed versions vary by distribution and were not provided, use the relevant Linux distribution security advisory and upgrade to the first fixed kernel for that distribution. Reboot into the updated kernel after installation. As a temporary mitigation where the driver is not required, prevent loading of the cmipci driver, commonly named snd_cmipci, by blacklisting it through the operating system’s module configuration and rebuilding initramfs if necessary. Also remove or disable unused C-Media PCI audio hardware where practical.

How to confirm the fix worked

Confirm the running kernel version is the vendor-fixed build, not merely that an updated package is installed. Verify with uname -r and the distribution package manager, then compare against the vendor advisory for this issue. Check whether the vulnerable driver is present or loaded using commands such as lsmod | grep snd_cmipci and modinfo snd_cmipci. If mitigation is used instead of patching, confirm the module cannot be loaded and is not included in early boot initramfs. Review kernel logs after reboot for absence of cmipci-related NULL pointer dereference, oops, panic, or snd_cmipci_spdif_controls stack traces.

Typical attack path

1. Identify a Linux system running a kernel build that contains the vulnerable ALSA cmipci driver code.
2. Confirm that the C-Media PCI audio driver is loaded or can be triggered, for example through compatible hardware or module initialization.
3. Create local memory pressure or otherwise attempt to force snd_ctl_new1() allocation failure during cmipci S/PDIF control setup.
4. Trigger the affected driver initialization or control creation path.
5. Cause the kernel to dereference a NULL control pointer, leading to a kernel oops, panic, or degraded system availability.

How to detect it

To determine whether this may have already been triggered, review kernel and system logs from journald, /var/log/kern.log, /var/log/messages, /var/log/syslog, crash dump facilities, kdump/vmcore records, and EDR kernel panic telemetry. Search for NULL pointer dereference, kernel oops, BUG, panic, or general protection fault entries with stack frames or module references involving snd_cmipci, snd_cmipci_spdif_controls(), snd_ctl_new1(), ALSA, or cmipci. Correlate any crash with module load events for snd_cmipci, device initialization, audio subsystem activity, or periods of heavy memory pressure and out-of-memory events. Because this vulnerability produces a crash rather than a persistent compromise, there may be no post-exploitation artifact beyond logs, crash dumps, uptime gaps, and reboot records.

• snd_cmipci
• cmipci
• snd_cmipci_spdif_controls
• snd_ctl_new1
• ALSA: cmipci
• NULL pointer dereference
• BUG: kernel NULL pointer dereference
• Oops:
• Kernel panic
• general protection fault
• Out of memory
• oom-killer
• /var/crash/
• /proc/vmcore
• module snd_cmipci

What your security team should do

• Prioritize patching systems that load snd_cmipci or have C-Media PCI audio hardware, especially where local users, containers with excessive device access, or untrusted workloads can influence resource pressure.
• Apply the vendor-fixed kernel update and reboot; kernel package installation alone is not sufficient until the fixed kernel is running.
• If the audio driver is unnecessary, blacklist snd_cmipci as a defense-in-depth mitigation and reduce the exposed kernel attack surface.
• Inventory systems for loaded cmipci modules using endpoint telemetry, configuration management, or EDR queries.
• Monitor kernel logs for NULL pointer dereference, oops, panic, or stack traces involving snd_cmipci_spdif_controls, snd_ctl_new1, or snd_cmipci.
• Treat this as availability-focused and lower urgency than known exploited remote vulnerabilities, but still include it in regular kernel patch cycles because kernel crashes can disrupt operations.