Riskcovery

CVE-2026-64134

ALSA: pcm: Don't setup bogus iov_iter for silencing

State
Published
Severity
7.8 High
Published
Jul 19, 2026
Updated
Oct 19, 2026
Reserved
Jul 19, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: pcm: Don't setup bogus iov_iter for silencing

At transition to the iov_iter for PCM data transfer, we blindly applied the iov_iter setup also for silencing (i.e. data = NULL), and it leads to a calculation of bogus iov_iter. Fortunately this didn't cause troubles on most of architectures but it goes wrong on RISC-V now, causing a NULL dereference.

Handle the NULL data case to treat the silencing in interleaved_copy() for addressing the bug above. noninterleaved_copy() has already the NULL data handling, so it doesn't need changes.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

Affected Products

ProductVersions
LinuxLinux
  • cf393babb37a1679a1ec1d864df1090353465e23 to before 41a766c647294842c9b17672449f8e011048cba9Affected
  • cf393babb37a1679a1ec1d864df1090353465e23 to before ce836587e594af39ff048d9b29dee0f5f10692c9Affected
  • cf393babb37a1679a1ec1d864df1090353465e23 to before feff0251386aa6bb180a0a1cf7c1f91ba868113dAffected
  • cf393babb37a1679a1ec1d864df1090353465e23 to before c9f6768515818d71bdfc20119a81f3332c53b9c6Affected
  • cf393babb37a1679a1ec1d864df1090353465e23 to before e4d3386b74fba8e01280484b67ee481ece00201eAffected
LinuxLinux
  • 6.6Affected
  • before 6.6Not affected
  • 6.6.142 through 6.6.*Not affected
  • 6.12.92 through 6.12.*Not affected
  • 6.18.34 through 6.18.*Not affected
  • 7.0.11 through 7.0.*Not affected
  • 7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.