CVE-2026-64489

What it actually does

This is a Linux kernel denial-of-service flaw in the ALSA Yamaha PCI sound driver. During creation of SPDIF mixer controls, the driver calls snd_ctl_new1(), which can return NULL if memory allocation fails. The vulnerable code dereferences the returned control object without checking for NULL, causing a kernel NULL pointer dereference. In practical terms, exploitation can crash the affected kernel path and may produce a kernel oops or panic depending on system configuration. The issue is not known to provide code execution or privilege escalation by itself.

Why it matters to the business

Systems running a vulnerable Linux kernel with the affected ALSA ymfpci driver available or loaded may be susceptible to local or device-adjacent denial of service, especially if an attacker can influence driver initialization while memory is constrained. The likely consequence is system instability, service interruption, or a forced reboot. Current public risk indicators are low: EPSS is 0.0018, it is not listed in CISA KEV, is not associated with ransomware campaigns, and no public exploit maturity is reported.

How an attack unfolds

An attacker would need a system where the vulnerable Linux kernel includes the ALSA ymfpci driver and the vulnerable control-creation path can be reached, typically during sound device initialization or driver/module loading. The attacker’s objective is to cause snd_ctl_new1() to fail by creating or relying on memory allocation pressure, then trigger snd_ymfpci_create_spdif_controls(). Because the vulnerable code dereferences the returned control pointer without validating it, a NULL return can lead to a kernel NULL pointer dereference. Depending on kernel panic settings and workload, this may crash the driver path, generate a kernel oops, or panic/reboot the host.

How to fix it

Apply a vendor-supplied Linux kernel update that includes the upstream fix for the ALSA ymfpci NULL return-value check. The fix adds NULL checks after snd_ctl_new1() calls in snd_ymfpci_create_spdif_controls() and returns -ENOMEM instead of dereferencing a NULL pointer. No exact fixed package versions were provided, so use distribution security advisories and kernel changelogs to identify the first fixed kernel for each platform. If immediate patching is not possible and the Yamaha PCI ALSA driver is not required, reduce exposure by preventing the snd_ymfpci module from loading, removing unnecessary sound hardware access, or disabling the affected audio subsystem on servers where it is not needed.

How to confirm the fix worked

Confirm that the running kernel package contains the vendor patch for the ALSA ymfpci snd_ctl_new1() NULL-check issue. Validate both installed and running kernel versions, because a reboot may be required after patching. On source-based or custom kernels, inspect the ymfpci driver code and verify that snd_ymfpci_create_spdif_controls() checks the return value of each snd_ctl_new1() call before dereferencing kctl. Also check whether the snd_ymfpci module is present or loaded using standard module inventory commands, and confirm any intended blacklist or module-disable control prevents it from loading after reboot.

Typical attack path

1. Identify a Linux system running a kernel that contains the vulnerable ALSA ymfpci driver code.
2. Confirm the affected Yamaha PCI sound driver is present, loadable, or already loaded.
3. Create conditions where kernel memory allocation failures are more likely, such as sustained local memory pressure.
4. Trigger driver initialization or SPDIF control creation through device initialization, module loading, or audio subsystem interaction.
5. Cause snd_ctl_new1() to return NULL and have the driver dereference the NULL control object.
6. Result in a kernel oops, panic, or service disruption depending on kernel configuration.

How to detect it

Look for evidence of kernel crashes or oops events involving the ALSA ymfpci driver, especially around module loading, sound device initialization, or periods of memory pressure. Useful log sources include kernel ring buffer output, system journal, /var/log/kern.log, /var/log/messages, crash dump infrastructure such as kdump, and endpoint telemetry that records module loads and kernel panics. Search for NULL pointer dereference messages with ymfpci, snd_ymfpci_create_spdif_controls, snd_ctl_new1, ALSA, or SPDIF in proximity. Also investigate recent loading of snd_ymfpci shortly before a crash and memory allocation failure messages preceding the fault. There are no known public threat actors or ransomware campaigns associated with this vulnerability at this time.

• BUG: kernel NULL pointer dereference
• Unable to handle kernel NULL pointer dereference
• snd_ymfpci_create_spdif_controls
• snd_ctl_new1
• snd_ymfpci
• ymfpci
• snd_ymfpci:
• ALSA: ymfpci
• Oops:
• Kernel panic - not syncing
• Out of memory
• page allocation failure
• module snd_ymfpci

What your security team should do

• Prioritize routine kernel patching for systems that include or load the ALSA ymfpci driver, especially shared-user Linux systems or systems where local users can create memory pressure.
• Inventory Linux hosts for the presence of the snd_ymfpci module and determine whether the affected driver is actually required.
• If the driver is unnecessary, disable or blacklist snd_ymfpci as a compensating control until patched.
• Review kernel panic-on-oops settings for critical systems, because this flaw may turn a kernel oops into a full reboot depending on configuration.
• Monitor distribution advisories for exact fixed kernel package versions and ensure patched kernels are booted, not merely installed.
• Treat any recurring ymfpci-related kernel oops or NULL pointer dereference as a potential exploitation or reliability signal and investigate promptly.