CVE-2026-64489
Last modified
CVE-2026-64489 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: ALSA: ymfpci: check snd_ctl_new1() return value snd_ctl_new1() can return NULL when memory allocation fails. snd_ymfpci_create_spdif_controls() does not check the return value before dereferencing kctl->id.device, which can lead to a NULL pointer dereference. Add NULL checks after snd_ctl_new1() calls and return -ENOMEM if any fails..
Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: ymfpci: check snd_ctl_new1() return value snd_ctl_new1() can return NULL when memory allocation fails. snd_ymfpci_create_spdif_controls() does not check the return value before dereferencing kctl->id.device, which can lead to a NULL pointer dereference. Add NULL checks after snd_ctl_new1() calls and return -ENOMEM if any fails.
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | >= 1f6c520932bca5be9e8dec137fccb2fc094a80fe, < d7c71dfd4b80f0eacac2c157a8a3a4c6e8b2e0d1; >= c9b83ae4a1609b1914ba7fc70826a3f3a8b234db, < 91095474eea29b95c9a8bceb9b501a2702b6c55f; >= c9b83ae4a1609b1914ba7fc70826a3f3a8b234db, < 02f33c2062c75e28abc7ad58ce86451cf3140455; >= c9b83ae4a1609b1914ba7fc70826a3f3a8b234db, < f6538a318947b627710b08a268bc80a48c23bde7; >= c9b83ae4a1609b1914ba7fc70826a3f3a8b234db, < 18ec7d7785be7a4ee8ea11e355122282caad4267; >= c9b83ae4a1609b1914ba7fc70826a3f3a8b234db, < e64d170346d00b580c0043de3e5ccb3e331c47d4; cf671d2462d9af50c328bcc185d2c7b9726f8093; >= 6.1.34, < 6.1.178; >= 6.3.8, < 6.4 |
| Linux | Linux | 6.4 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-64489?
How severe is CVE-2026-64489?
How do I fix CVE-2026-64489?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-64483In the Linux kernel, the following vulnerability has been re…
- CVE-2026-64484In the Linux kernel, the following vulnerability has been re…
- CVE-2026-64485In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2026-64486In the Linux kernel, the following vulnerability has been re…
- CVE-2026-64487In the Linux kernel, the following vulnerability has been re…
- CVE-2026-64488In the Linux kernel, the following vulnerability has been re…
- CVE-2026-6449The Booking for Appointments and Events Calendar – Amelia pl…5.3
- CVE-2026-64490In the Linux kernel, the following vulnerability has been re…8.4
- CVE-2026-64491In the Linux kernel, the following vulnerability has been re…
- CVE-2026-64492In the Linux kernel, the following vulnerability has been re…
- CVE-2026-64493In the Linux kernel, the following vulnerability has been re…
- CVE-2026-64494In the Linux kernel, the following vulnerability has been re…
Are you affected by CVE-2026-64489?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST