Answer in brief
CVE-2026-64489 records a Unknown severity vulnerability in ALSA: ymfpci: check snd_ctl_new1() return value. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=1f6c520932bca5be9e8dec137fccb2fc094a80fe <d7c71dfd4b80f0eacac2c157a8a3a4c6e8b2e0d1 || >=c9b83ae4a1609b1914ba7fc70826a3f3a8b234db <91095474eea29b95c9a8bceb9b501a2702b6c55f || >=c9b83ae4a1609b1914ba7fc70826a3f3a8b234db <02f33c2062c75e28abc7ad58ce86451cf3140455 || >=c9b83ae4a1609b1914ba7fc70826a3f3a8b234db <f6538a318947b627710b08a268bc80a48c23bde7 || >=c9b83ae4a1609b1914ba7fc70826a3f3a8b234db <18ec7d7785be7a4ee8ea11e355122282caad4267 || >=c9b83ae4a1609b1914ba7fc70826a3f3a8b234db <e64d170346d00b580c0043de3e5ccb3e331c47d4 || cf671d2462d9af50c328bcc185d2c7b9726f8093 || >=6.1.34 <6.1.178 || >=6.3.8 <6.4 | d7c71dfd4b80f0eacac2c157a8a3a4c6e8b2e0d1, 91095474eea29b95c9a8bceb9b501a2702b6c55f, 02f33c2062c75e28abc7ad58ce86451cf3140455, f6538a318947b627710b08a268bc80a48c23bde7, 18ec7d7785be7a4ee8ea11e355122282caad4267, e64d170346d00b580c0043de3e5ccb3e331c47d4, 6.1.178, 6.4 |
| Linux/Linuxgeneric | 6.4 | Not reported |
Published upstream
Jul 25, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 17, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 17, 2026
In the Linux kernel, the following vulnerability has been resolved: ALSA: ymfpci: check snd_ctl_new1() return value snd_ctl_new1() can return NULL when memory allocation fails. snd_ymfpci_create_spdif_controls() does not check the return value before dereferencing kctl->id.device, which can lead to a NULL pointer dereference. Add NULL checks after snd_ctl_new1() calls and return -ENOMEM if any fails.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-64489 records a Unknown severity vulnerability in ALSA: ymfpci: check snd_ctl_new1() return value. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=1f6c520932bca5be9e8dec137fccb2fc094a80fe <d7c71dfd4b80f0eacac2c157a8a3a4c6e8b2e0d1 || >=c9b83ae4a1609b1914ba7fc70826a3f3a8b234db <91095474eea29b95c9a8bceb9b501a2702b6c55f || >=c9b83ae4a1609b1914ba7fc70826a3f3a8b234db <02f33c2062c75e28abc7ad58ce86451cf3140455 || >=c9b83ae4a1609b1914ba7fc70826a3f3a8b234db <f6538a318947b627710b08a268bc80a48c23bde7 || >=c9b83ae4a1609b1914ba7fc70826a3f3a8b234db <18ec7d7785be7a4ee8ea11e355122282caad4267 || >=c9b83ae4a1609b1914ba7fc70826a3f3a8b234db <e64d170346d00b580c0043de3e5ccb3e331c47d4 || cf671d2462d9af50c328bcc185d2c7b9726f8093 || >=6.1.34 <6.1.178 || >=6.3.8 <6.4 | d7c71dfd4b80f0eacac2c157a8a3a4c6e8b2e0d1, 91095474eea29b95c9a8bceb9b501a2702b6c55f, 02f33c2062c75e28abc7ad58ce86451cf3140455, f6538a318947b627710b08a268bc80a48c23bde7, 18ec7d7785be7a4ee8ea11e355122282caad4267, e64d170346d00b580c0043de3e5ccb3e331c47d4, 6.1.178, 6.4 |
| Linux/Linuxgeneric | 6.4 | Not reported |
Published upstream
Jul 25, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 17, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 17, 2026
In the Linux kernel, the following vulnerability has been resolved: ALSA: ymfpci: check snd_ctl_new1() return value snd_ctl_new1() can return NULL when memory allocation fails. snd_ymfpci_create_spdif_controls() does not check the return value before dereferencing kctl->id.device, which can lead to a NULL pointer dereference. Add NULL checks after snd_ctl_new1() calls and return -ENOMEM if any fails.
Quoted source text, attributed separately from HOL analysis.