CVE-2026-64489
Unknown
Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: ymfpci: check snd_ctl_new1() return value snd_ctl_new1() can return NULL when memory allocation fails. snd_ymfpci_create_spdif_controls() does not check the return value before dereferencing kctl->id.device, which can lead to a NULL pointer dereference. Add NULL checks after snd_ctl_new1() calls and return -ENOMEM if any fails.
SeverityUnknown
CVSS—
Exploit probability—
Product
Linux
PublishedJul 25, 2026
First seenJul 25, 2026
How to fix
Update
- Linux Linuxd7c71dfd4b80f0eacac2c157a8a3a4c6e8b2e0d1, 91095474eea29b95c9a8bceb9b501a2702b6c55f, 02f33c2062c75e28abc7ad58ce86451cf3140455, f6538a318947b627710b08a268bc80a48c23bde7, 18ec7d7785be7a4ee8ea11e355122282caad4267, e64d170346d00b580c0043de3e5ccb3e331c47d4, 6.1.178, 6.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 1f6c520932bca5be9e8dec137fccb2fc094a80fe ≤ v < d7c71dfd4b80f0eacac2c157a8a3a4c6e8b2e0d1, c9b83ae4a1609b1914ba7fc70826a3f3a8b234db ≤ v < 91095474eea29b95c9a8bceb9b501a2702b6c55f, c9b83ae4a1609b1914ba7fc70826a3f3a8b234db ≤ v < 02f33c2062c75e28abc7ad58ce86451cf3140455, c9b83ae4a1609b1914ba7fc70826a3f3a8b234db ≤ v < f6538a318947b627710b08a268bc80a48c23bde7, c9b83ae4a1609b1914ba7fc70826a3f3a8b234db ≤ v < 18ec7d7785be7a4ee8ea11e355122282caad4267, c9b83ae4a1609b1914ba7fc70826a3f3a8b234db ≤ v < e64d170346d00b580c0043de3e5ccb3e331c47d4, cf671d2462d9af50c328bcc185d2c7b9726f8093, 6.1.34 ≤ v < 6.1.178, 6.3.8 ≤ v < 6.4, 6.4 | d7c71dfd4b80f0eacac2c157a8a3a4c6e8b2e0d1, 91095474eea29b95c9a8bceb9b501a2702b6c55f, 02f33c2062c75e28abc7ad58ce86451cf3140455, f6538a318947b627710b08a268bc80a48c23bde7, 18ec7d7785be7a4ee8ea11e355122282caad4267, e64d170346d00b580c0043de3e5ccb3e331c47d4, 6.1.178, 6.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.