CVE-2026-64107 Overview
CVE-2026-64107 is a null pointer dereference vulnerability in the Linux kernel's ALSA System-on-Chip (ASoC) subsystem. The flaw resides in the pcm512x codec driver, specifically inside the pcm512x_overclock_xxx_put() handler. The function is registered as a general mixer kcontrol rather than a Dynamic Audio Power Management (DAPM) kcontrol, but it incorrectly accesses struct snd_soc_dapm_context through snd_soc_dapm_kcontrol_to_dapm(). Because the mixer control has no associated DAPM widget, this call returns a NULL pointer and triggers a kernel dereference. The fix routes the driver through snd_soc_component_to_dapm() instead.
Critical Impact
A local user with access to ALSA mixer controls on a system using the pcm512x codec can trigger a NULL pointer dereference in the kernel, resulting in denial of service.
Affected Products
- Linux kernel builds that compile the snd-soc-pcm512x codec driver
- Systems using Texas Instruments PCM512x-family audio DACs (for example PCM5121, PCM5122, PCM5142)
- Distributions shipping the affected mainline kernel prior to the referenced stable commits
Discovery Timeline
- 2026-07-19 - CVE-2026-64107 published to NVD
- 2026-07-19 - Last updated in NVD database
Technical Details for CVE-2026-64107
Vulnerability Analysis
The pcm512x driver exposes overclocking parameters as ALSA mixer controls using the standard SOC_SINGLE_EXT style registration. The put callback, pcm512x_overclock_xxx_put(), is invoked when userspace writes a new value through snd_ctl_write() or amixer. The callback attempts to resolve the current DAPM context to check power state before applying the change.
Because the control is a mixer element rather than a DAPM control, no widget list is attached to the kcontrol. Calling snd_soc_dapm_kcontrol_to_dapm() on such a control walks an empty widget list and returns NULL. Subsequent dereferences of the returned snd_soc_dapm_context pointer cause an oops in kernel context. This falls under Null Pointer Dereference [CWE-476].
Root Cause
The root cause is an API mismatch. snd_soc_dapm_kcontrol_to_dapm() is valid only for controls created as DAPM controls, where a widget backreference exists in dapm_kcontrol_data. The pcm512x driver registered its overclock controls through the general mixer path, leaving that backreference empty. The corrected code uses snd_soc_component_to_dapm(), which derives the DAPM context directly from the component the control belongs to.
Attack Vector
Triggering the fault requires local access and permission to write to the ALSA control device (/dev/snd/controlC*) on hardware exposing the pcm512x codec. An attacker with such access writes any value to the overclock mixer controls, causing the kernel to dereference NULL and panic if panic_on_oops is set, or to kill the offending task and leave a stale kernel state otherwise. Remote exploitation is not applicable. Technical details are available in the Linux stable commit 285159ca199c and the companion stable commit 09e8f9a9aa19.
Detection Methods for CVE-2026-64107
Indicators of Compromise
- Kernel oops entries in dmesg or journalctl -k referencing pcm512x_overclock_pll_put, pcm512x_overclock_dac_put, or pcm512x_overclock_dsp_put
- BUG: kernel NULL pointer dereference messages with a call stack passing through snd_soc_dapm_kcontrol_to_dapm
- Unexpected audio subsystem crashes on devices using PCM512x DACs after mixer writes from userspace
Detection Strategies
- Query loaded kernel version and module list to identify hosts running snd_soc_pcm512x on unpatched kernels
- Correlate ALSA control writes (amixer, alsactl) with kernel crash telemetry to identify probing behavior
- Monitor for repeated audio service restarts, which may indicate someone iterating on the mixer control to trigger the fault
Monitoring Recommendations
- Ship /var/log/kern.log and journald kernel facility events to a central log store for kernel oops correlation
- Alert on kernel panic and oops counters increasing on hosts with the pcm512x driver loaded
- Track process execution of ALSA control utilities by non-audio users on server and embedded systems
How to Mitigate CVE-2026-64107
Immediate Actions Required
- Apply the upstream stable kernel updates that include commits 285159ca199c and 09e8f9a9aa19
- If patching is delayed, unload the snd_soc_pcm512x module on systems where the codec is not required
- Restrict access to /dev/snd/controlC* device nodes to the audio group and remove unnecessary users from that group
Patch Information
The fix replaces the incorrect snd_soc_dapm_kcontrol_to_dapm() call inside pcm512x_overclock_xxx_put() with snd_soc_component_to_dapm(), which returns a valid DAPM context for the component regardless of control type. Rebuild and deploy the kernel from any stable branch that has merged the referenced commits, then reboot affected hosts.
Workarounds
- Blacklist the snd_soc_pcm512x module in /etc/modprobe.d/ on systems that do not need the codec
- Tighten permissions on ALSA control device nodes using udev rules to prevent unprivileged local users from writing mixer values
- Enable kernel.panic_on_oops=0 only where continued operation after an oops is acceptable, and monitor for recurrence
# Blacklist the affected codec module until the kernel is patched
echo 'blacklist snd_soc_pcm512x' | sudo tee /etc/modprobe.d/blacklist-pcm512x.conf
sudo depmod -a
sudo rmmod snd_soc_pcm512x 2>/dev/null || true
# Verify the module is no longer loaded
lsmod | grep pcm512x
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
