CVE-2026-97418 ALSA: es18xx: check control allocation before private data setup
A null pointer dereference in the ALSA es18xx driver can cause a kernel crash, leading to denial of service for local attackers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-97418?
CVE-2026-97418 is a vulnerability in Linux, published on 24 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ALSA: es18xx: check control allocation before private data setup
snd_es18xx_mixer() creates controls with snd_ctl_new1() and then stores bookkeeping pointers or sets private_free before calling snd_ctl_add(). snd_ctl_new1() can return NULL on allocation failure, so those writes can dereference a NULL control pointer.
Check the returned control pointers before using them and return -ENOMEM on allocation failure.
Which versions are affected by CVE-2026-97418?
How do I fix CVE-2026-97418?
Apply the vendor's patch.
Is CVE-2026-97418 being exploited?
There is no known exploitation of CVE-2026-97418 in the wild and no public exploit code.
Sources
Also known as AZL-103646, BELL-CVE-2026-97418, DEBIAN-CVE-2026-97418, GHSA-8wg7-gxr2-289w, UBUNTU-CVE-2026-97418.