CVE-2026-64134

Source
https://cve.org/CVERecord?id=CVE-2026-64134
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-64134.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-64134
Downstream
Published
2026-07-19T15:40:28.974Z
Modified
2026-07-22T03:31:59.391411532Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
ALSA: pcm: Don't setup bogus iov_iter for silencing
Details

In the Linux kernel, the following vulnerability has been resolved:

ALSA: pcm: Don't setup bogus iov_iter for silencing

At transition to the ioviter for PCM data transfer, we blindly applied the ioviter setup also for silencing (i.e. data = NULL), and it leads to a calculation of bogus iov_iter. Fortunately this didn't cause troubles on most of architectures but it goes wrong on RISC-V now, causing a NULL dereference.

Handle the NULL data case to treat the silencing in interleavedcopy() for addressing the bug above. noninterleavedcopy() has already the NULL data handling, so it doesn't need changes.

Database specific
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64134.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
cf393babb37a1679a1ec1d864df1090353465e23
Fixed
41a766c647294842c9b17672449f8e011048cba9
Fixed
ce836587e594af39ff048d9b29dee0f5f10692c9
Fixed
feff0251386aa6bb180a0a1cf7c1f91ba868113d
Fixed
c9f6768515818d71bdfc20119a81f3332c53b9c6
Fixed
e4d3386b74fba8e01280484b67ee481ece00201e

Database specific

source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-64134.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.6.0
Fixed
6.6.142
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.92
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.34
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.0.11

Database specific

source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-64134.json"