CVE-2026-64001: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64001 Overview

CVE-2026-64001 is a use-after-free vulnerability in the Linux kernel's Advanced Linux Sound Architecture (ALSA) Pulse-Code Modulation (PCM) Open Sound System (OSS) compatibility layer. The flaw resides in snd_pcm_oss_proc_write(), which links a newly allocated setup entry into the OSS setup_list before duplicating the associated task name. When the task-name allocation fails, the error path frees the already linked entry, leaving setup_list pointing at freed memory. A subsequent OSS device open then traverses the stale entry in snd_pcm_oss_look_for_setup() and dereferences freed memory.

Critical Impact
A local user with access to the ALSA OSS proc interface can trigger memory corruption in the kernel, potentially leading to denial of service or local privilege escalation.

Affected Products

Linux kernel (ALSA PCM OSS subsystem)
Distributions shipping affected upstream kernel versions prior to the referenced stable commits
Systems with snd-pcm-oss module loaded and OSS proc interface accessible

Discovery Timeline

2026-07-19 - CVE-2026-64001 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-64001

Vulnerability Analysis

The vulnerability is a use-after-free (UAF) condition in the ALSA PCM OSS compatibility layer of the Linux kernel. The affected function, snd_pcm_oss_proc_write(), handles writes to the OSS setup proc file used to configure per-application PCM parameters. The function's ordering of operations creates a window where a linked list contains a pointer to an object that has been freed on an error path.

Because the freed entry remains reachable from setup_list, later callers such as snd_pcm_oss_look_for_setup() iterate the list and dereference freed memory. This can lead to kernel memory corruption, information disclosure, or a kernel oops resulting in denial of service. On systems where an attacker can control heap reuse, UAF conditions in the kernel are commonly leveraged as primitives for local privilege escalation.

Root Cause

The root cause is incorrect ordering of allocation and list insertion in snd_pcm_oss_proc_write(). The setup entry is published on the global setup_list before the task-name string is duplicated. When the task-name allocation fails, cleanup code frees the entry, but the list still holds a dangling pointer to the freed structure. A related issue is that the initial proc read iterator is fetched before setup_mutex is acquired, breaking the invariant that all setup_list traversal occurs under the same locking discipline.

Attack Vector

Exploitation requires local access to the affected system and the ability to write to the ALSA OSS proc entry, which typically requires appropriate privileges over the sound device. An attacker triggers repeated writes designed to fail the task-name allocation, corrupting setup_list. A subsequent OSS device open then walks the poisoned list. The vulnerability manifests during normal error-path handling and does not require memory pressure to be manually induced when combined with allocation-fault injection or resource exhaustion techniques.

Because no verified public exploit is available, technical readers should consult the upstream fix commits for the precise code paths involved. See the Kernel Git Commit 4cc54bd and Kernel Git Commit e13922b for the corrected allocation ordering.

Detection Methods for CVE-2026-64001

Indicators of Compromise

Kernel oops or panic messages referencing snd_pcm_oss_look_for_setup or snd_pcm_oss_proc_write in dmesg or /var/log/kern.log
KASAN (Kernel Address Sanitizer) reports flagging use-after-free reads within the ALSA OSS subsystem
Unexpected processes writing to /proc/asound/*/oss or related OSS setup proc entries
Repeated failed writes to the OSS proc setup interface followed by device-open activity

Detection Strategies

Enable KASAN on test and staging kernels to catch UAF conditions in the ALSA OSS path before they reach production
Audit which user accounts have write access to ALSA OSS proc files and monitor for anomalous write patterns
Correlate kernel crash telemetry with process ancestry to identify local users triggering sound-subsystem faults
Use eBPF or auditd rules to log writes to /proc/asound/ setup entries

Monitoring Recommendations

Forward kernel logs and crash dumps to a centralized data lake for retrospective analysis of ALSA-related faults
Alert on repeated snd_pcm_oss_* symbols appearing in kernel stack traces across the fleet
Track loading of the snd-pcm-oss module on servers where OSS compatibility is not required

How to Mitigate CVE-2026-64001

Immediate Actions Required

Apply the upstream stable kernel patches referenced below and reboot affected systems
Where OSS compatibility is not needed, blacklist the snd-pcm-oss module to remove the vulnerable code path entirely
Restrict write access to /proc/asound/ entries to trusted administrative accounts
Inventory Linux hosts running kernels that predate the fix and prioritize patching multi-user systems

Patch Information

The vulnerability is resolved in upstream Linux stable trees. The fix reorders allocation so that the task name is duplicated and the setup entry is fully initialized before being published on setup_list, and it acquires setup_mutex before fetching the initial proc read iterator. Refer to the following stable commits: Kernel Git Commit 4cc54bd, Kernel Git Commit 8be4efd, Kernel Git Commit be38723, and Kernel Git Commit e13922b.

Workarounds

Unload and blacklist the snd-pcm-oss module on systems that do not require OSS PCM compatibility
Tighten Discretionary Access Control (DAC) permissions on ALSA proc entries to prevent untrusted local users from writing to them
Remove membership of the audio group from accounts that do not need direct sound-device access

bash

# Blacklist the vulnerable OSS PCM module
echo "blacklist snd-pcm-oss" | sudo tee /etc/modprobe.d/disable-snd-pcm-oss.conf
sudo rmmod snd_pcm_oss 2>/dev/null || true

# Verify the module is no longer loaded
lsmod | grep snd_pcm_oss