Junglewise Threat Intelligence

CVE-2026-64482: Linux kernel NULL pointer dereference in ALSA GUS driver

CVE-2026-64482 · Severity: info · CVSS 0 · Published 2026-07-25

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's sound subsystem (ALSA) specifically affecting Gravis UltraSound (GUS) hardware drivers. Under conditions of extreme memory pressure, the system could experience a crash (kernel panic) when attempting to initialize audio controls. This issue primarily impacts system stability and availability for users with specific legacy audio hardware configurations.

Technical details

A vulnerability exists in the sound/isa/gus/gus_pcm.c component of the Linux kernel. The function snd_gf1_pcm_new() calls snd_ctl_new1() to allocate a new control, but fails to verify if the returned pointer is NULL before dereferencing it to set kctl->id.index. This lack of validation leads to a NULL pointer dereference if memory allocation fails. An attacker or a system under heavy load could trigger this condition, resulting in a kernel oops or denial of service. The issue has been resolved by adding a NULL check and returning -ENOMEM upon failure.

Affected products

  • Linux Linux kernel 6.1.34 to 6.1.178, 6.3.8 to 6.4, 6.4 and later

Timeline

  • 2026-05-28: patched: Initial fix committed to Linux kernel mainline.
  • 2026-07-25: disclosed: CVE-2026-64482 published.

References

Related threats