CVE-2026-64134 ALSA: pcm: Don't setup bogus iov_iter for silencing
A NULL pointer dereference in the Linux kernel ALSA PCM subsystem can cause a system crash on RISC-V architectures during audio silencing operations.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64134?
CVE-2026-64134 is a high-severity vulnerability in Linux kernel, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ALSA: pcm: Don't setup bogus iov_iter for silencing
At transition to the iov_iter for PCM data transfer, we blindly applied the iov_iter setup also for silencing (i.e. data = NULL), and it leads to a calculation of bogus iov_iter. Fortunately this didn't cause troubles on most of architectures but it goes wrong on RISC-V now, causing a NULL dereference.
Handle the NULL data case to treat the silencing in interleaved_copy() for addressing the bug above. noninterleaved_copy() has already the NULL data handling, so it doesn't need changes.
Weakness: CWE-476
Which versions are affected by CVE-2026-64134?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-64134?
Apply the vendor's patch.
Is CVE-2026-64134 being exploited?
There is no known exploitation of CVE-2026-64134 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-64134, DEBIAN-CVE-2026-64134, GHSA-g8p3-wvvx-m6mf, UBUNTU-CVE-2026-64134.