CVE-2026-64486
Published Jul 25, 2026
Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: cmipci: check snd_ctl_new1() return value snd_ctl_new1() can return NULL when memory allocation fails. snd_cmipci_spdif_controls() does not check the return value before dereferencing kctl->id.device, which can lead to a NULL pointer dereference. Add NULL checks after snd_ctl_new1() calls and return -ENOMEM if any fails.
Is your site exposed to CVE-2026-64486?
Run a free security scan — no signup, results in seconds.
EPSS — Exploit Prediction
0.0022
Probability of exploitation
0.12%
Percentile rank
EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.
References
Other References
https://git.kernel.org/stable/c/4dd5b0b1a52a8d6e59a3f217204817228ce0238b
https://git.kernel.org/stable/c/67e9ea92cd598cba1783ff701553c776a6cedee9
https://git.kernel.org/stable/c/8825a06bfa7932a7a74dec01669d405df0b47286
https://git.kernel.org/stable/c/af2b009b773bc42995546507963e5e78970dc3ed
https://git.kernel.org/stable/c/b44888c33c4f11277d0e5e023338f2740232a4ed
https://git.kernel.org/stable/c/c205bd1b28fb7e5f1061a4e78813fad7d315cb3e
Frequently Asked Questions
What is CVE-2026-64486? +
In the Linux kernel, the following vulnerability has been resolved:
ALSA: cmipci: check snd_ctl_new1() return value
snd_ctl_new1() can return NULL when memory allocation fails.
snd_cmipci_spdif_controls() does not check the return value before
dereferencing kctl->id.device, which can lead to a NULL pointer
dereference.
Add NULL checks after snd_ctl_new1() calls and return -ENOMEM if any
fails.
How do I check if I'm vulnerable to CVE-2026-64486? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.