SB2026072767 - NULL pointer dereference in Linux kernel pci
Published: July 27, 2026
Security Bulletin ID
SB2026072767
CSH Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) NULL pointer dereference (CVE-ID: CVE-2026-64484)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a NULL pointer dereference in snd_es1938_mixer() in sound/pci/es1938.c when handling mixer control initialization. A local user can trigger a memory allocation failure and reach the vulnerable code path to cause a denial of service.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/1949163dee39e0e4a1468f37dd7302962f6af45a
- https://git.kernel.org/stable/c/1edd1f02dddd20aeb6066ded41017615766ea42f
- https://git.kernel.org/stable/c/41759affbcfe3d51a32900da9547a1ffd744a85f
- https://git.kernel.org/stable/c/6c4efebaf73e217efbd08cdbda805758a7db3680
- https://git.kernel.org/stable/c/7531a37720c2545a480fd0fa464978569bf9d6a2
- https://git.kernel.org/stable/c/96cad5bd7d0a176db3fdc06717a41271247336bd
- https://git.kernel.org/stable/c/9e53e99b6fa3cd82992d963cbff58dbbd1df8651
- https://git.kernel.org/stable/c/af01c48e17a66fa038af210a5c49d6cdefd210bd