PT-2026-61318 · Linux · Linux Kernel

CVE-2026-64001 · Published 2026-07-19 · Updated 2026-07-19

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A Use-After-Free (UAF) issue exists in the ALSA PCM OSS component. The function snd pcm oss proc write() links a newly allocated setup entry into the OSS setup list before duplicating the task name. If the task-name allocation fails, the error path frees the linked entry, leaving the setup list pointing to freed memory. Subsequently, an OSS device open operation can trigger a dereference of this freed memory when snd pcm oss look for setup() traverses the stale list entry.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-64001

Affected Products

Linux Kernel

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-64001 · Security Note
• https://twitter.com/CVEnew/status/2078861440643965362 · Twitter Post
• https://twitter.com/infoflowcloud/status/2078862647202627638 · Twitter Post
• https://git.kernel.org/stable/c/be387230dc22d870afd0e5d35912b07c2bc323bd · Note
• https://git.kernel.org/stable/c/8be4efd0dc0093eb7a02ad1aac936bca2a1f04ce · Note
• https://git.kernel.org/stable/c/4cc54bdd54b337e77115be5b55577d1c58608eae · Note
• https://git.kernel.org/stable/c/e13922bb97b4e6f94f8ac02d034f2d4bd65eeb3c · Note