PT-2026-61451 · Linux · Linux

CVE-2026-64134 · Published 2026-07-19 · Updated 2026-07-19

NVD

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

ALSA: pcm: Don't setup bogus iov iter for silencing

At transition to the iov iter for PCM data transfer, we blindly applied the iov iter setup also for silencing (i.e. data = NULL), and it leads to a calculation of bogus iov iter. Fortunately this didn't cause troubles on most of architectures but it goes wrong on RISC-V now, causing a NULL dereference.

Handle the NULL data case to treat the silencing in interleaved copy() for addressing the bug above. noninterleaved copy() has already the NULL data handling, so it doesn't need changes.

Fix

Related Identifiers

CVE-2026-64134

Affected Products

Linux

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-64134 · Security Note
• https://git.kernel.org/stable/c/41a766c647294842c9b17672449f8e011048cba9 · Note
• https://git.kernel.org/stable/c/c9f6768515818d71bdfc20119a81f3332c53b9c6 · Note
• https://git.kernel.org/stable/c/ce836587e594af39ff048d9b29dee0f5f10692c9 · Note
• https://git.kernel.org/stable/c/e4d3386b74fba8e01280484b67ee481ece00201e · Note
• https://git.kernel.org/stable/c/feff0251386aa6bb180a0a1cf7c1f91ba868113d · Note