CVE-2026-64134: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64134 Overview

CVE-2026-64134 is a NULL pointer dereference vulnerability in the Linux kernel's Advanced Linux Sound Architecture (ALSA) PCM subsystem. The flaw resides in the transition logic that sets up iov_iter structures for PCM data transfer. When the subsystem processes silencing operations, it passes data = NULL through the same iov_iter setup path used for actual data transfer, producing an invalid iterator.

On most architectures the malformed iterator remained benign, but on RISC-V it triggers a NULL dereference and kernel crash. A local, low-privileged user can leverage the flaw against affected systems.

Critical Impact
Local unprivileged users can trigger a kernel NULL pointer dereference through ALSA PCM operations, leading to denial of service and possible impact to system integrity on RISC-V platforms.

Affected Products

Linux kernel versions containing the ALSA PCM iov_iter transition code prior to the referenced fixes
RISC-V architecture builds are confirmed affected by the NULL dereference
Distributions shipping vulnerable stable kernel branches until backports are applied

Discovery Timeline

2026-07-19 - CVE-2026-64134 published to the National Vulnerability Database
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64134

Vulnerability Analysis

The Linux kernel's ALSA PCM layer transitioned its data transfer path to use iov_iter, the kernel's unified iterator abstraction for scatter/gather I/O. During this transition, the code applied the same iov_iter initialization to silencing operations, which supply a NULL data pointer instead of a user buffer. The resulting iterator contains bogus length and address calculations.

On architectures with lenient memory access semantics, the malformed iterator did not manifest as a fault. On RISC-V, however, the iterator dereferences a NULL address inside the copy path, crashing the kernel. The upstream fix modifies interleaved_copy() to detect the NULL data case and handle silencing explicitly. The noninterleaved_copy() function already contained the required NULL check and was left unchanged.

Root Cause

The root cause is an improper input validation defect [CWE-476] in ALSA's PCM copy dispatch. The iov_iter setup code assumes a valid user buffer pointer and does not distinguish silencing requests, which legitimately pass data = NULL, from real transfer requests.

Attack Vector

Exploitation requires local access with permission to open an ALSA PCM device, typically membership in the audio group or default user access on desktop distributions. An attacker issues a PCM operation that triggers the silencing path on a vulnerable RISC-V kernel, producing a NULL dereference and kernel oops. Repeated triggering results in denial of service.

The vulnerability is described in the ALSA PCM copy dispatch logic. See the upstream commits 41a766c, c9f6768, ce83658, e4d3386, and feff025 for the applied fixes.

Detection Methods for CVE-2026-64134

Indicators of Compromise

Kernel oops or panic messages referencing interleaved_copy or snd_pcm_lib_write in dmesg and /var/log/kern.log
Sudden audio subsystem failures on RISC-V hosts following PCM device access
Unexpected process termination for audio-related services after opening /dev/snd/pcm* devices

Detection Strategies

Inventory running kernel versions across Linux fleets and correlate against the fixed commits published on git.kernel.org
Monitor kernel crash telemetry and kdump output for NULL dereferences in ALSA PCM code paths
Audit access to /dev/snd/ device nodes by unprivileged processes and flag anomalous open patterns

Monitoring Recommendations

Forward kern.log and dmesg output to a centralized logging pipeline and alert on ALSA-related oops signatures
Track kernel package versions on RISC-V endpoints and build systems as a first-class compliance metric
Baseline expected callers of /dev/snd/pcm* devices and alert on unexpected local processes

How to Mitigate CVE-2026-64134

Immediate Actions Required

Apply the vendor-supplied kernel update that includes the ALSA PCM silencing fix on all affected systems, prioritizing RISC-V hosts
Restrict access to /dev/snd/ device nodes to trusted users where audio functionality is not required
Enable kdump or equivalent crash collection to capture forensic data if the flaw is triggered before patching

Patch Information

The fix modifies interleaved_copy() in the ALSA PCM layer to handle data == NULL for silencing operations rather than passing the value through the generic iov_iter setup. Fixes are available in the following upstream stable commits: Kernel Git Commit 41a766c, Kernel Git Commit c9f6768, Kernel Git Commit ce83658, Kernel Git Commit e4d3386, and Kernel Git Commit feff025.

Workarounds

Remove or blacklist ALSA PCM kernel modules on RISC-V systems that do not require audio, using modprobe.d configuration
Tighten udev rules to restrict /dev/snd/pcm* access to a limited service account until patches are deployed
Deploy container and VM policies that deny audio device pass-through to untrusted workloads

bash

# Configuration example: verify kernel version and restrict ALSA device access
uname -r
getent group audio
ls -l /dev/snd/
# Optional: blacklist snd_pcm on systems without audio requirements
echo "blacklist snd_pcm" | sudo tee /etc/modprobe.d/disable-alsa-pcm.conf
sudo update-initramfs -u