ALSA: cmipci: check snd_ctl_new1() return value (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.18 % · percentile 8 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Received
Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: cmipci: check snd_ctl_new1() return value snd_ctl_new1() can return NULL when memory allocation fails. snd_cmipci_spdif_controls() does not check the return value before dereferencing kctl->id.device, which can lead to a NULL pointer dereference. Add NULL checks after snd_ctl_new1() calls and return -ENOMEM if any fails.
References
- https://git.kernel.org/stable/c/b44888c33c4f11277d0e5e023338f2740232a4ed
- https://git.kernel.org/stable/c/8825a06bfa7932a7a74dec01669d405df0b47286
- https://git.kernel.org/stable/c/4dd5b0b1a52a8d6e59a3f217204817228ce0238b
- https://git.kernel.org/stable/c/af2b009b773bc42995546507963e5e78970dc3ed
- https://git.kernel.org/stable/c/67e9ea92cd598cba1783ff701553c776a6cedee9
- https://git.kernel.org/stable/c/c205bd1b28fb7e5f1061a4e78813fad7d315cb3e
European references
- ENISA EUVD · EUVD-2026-48830
- GCVE · GCVE-0-2026-64486
CERT-FR advisories
- CERTFR-2026-AVI-1333 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1255 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1252 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1229 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1203 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1202 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1164 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1162 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1031 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0982 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 3454490e0396191f8f9c215fccf5deef76abffb5 < b44888c33c4f11277d0e5e023338f2740232a4ed ; affected f2f312ad88c68a7f4a7789b9269ae33af3c7c7e9 < 8825a06bfa7932a7a74dec01669d405df0b47286 ; affected f2f312ad88c68a7f4a7789b9269ae33af3c7c7e9 < 4dd5b0b1a52a8d6e59a3f217204817228ce0238b ; affected f2f312ad88c68a7f4a7789b9269ae33af3c7c7e9 < af2b009b773bc42995546507963e5e78970dc3ed ; affected f2f312ad88c68a7f4a7789b9269ae33af3c7c7e9 < 67e9ea92cd598cba1783ff701553c776a6cedee9 ; affected f2f312ad88c68a7f4a7789b9269ae33af3c7c7e9 < c205bd1b28fb7e5f1061a4e78813fad7d315cb3e |
| Linux · Linux | affected 6.4 ; unaffected 0 < 6.4 ; unaffected 6.1.178 ≤ 6.1.* ; unaffected 6.6.145 ≤ 6.6.* ; unaffected 6.12.96 ≤ 6.12.* ; unaffected 6.18.39 ≤ 6.18.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |