In the Linux kernel, the following vulnerability has been resolved:

ALSA: pcm: Don't setup bogus iov_iter for silencing

At transition to the iov_iter for PCM data transfer, we blindly
applied the iov_iter setup also for silencing (i.e. data = NULL), and
it leads to a calculation of bogus iov_iter. Fortunately this didn't
cause troubles on most of architectures but it goes wrong on RISC-V
now, causing a NULL dereference.

Handle the NULL data case to treat the silencing in interleaved_copy()
for addressing the bug above. noninterleaved_copy() has already the
NULL data handling, so it doesn't need changes.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00168.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
cf393babb37a1679a1ec1d864df1090353465e23 affected < 41a766c647294842c9b17672449f8e011048cba9
cf393babb37a1679a1ec1d864df1090353465e23 affected < ce836587e594af39ff048d9b29dee0f5f10692c9
cf393babb37a1679a1ec1d864df1090353465e23 affected < feff0251386aa6bb180a0a1cf7c1f91ba868113d
cf393babb37a1679a1ec1d864df1090353465e23 affected < c9f6768515818d71bdfc20119a81f3332c53b9c6
cf393babb37a1679a1ec1d864df1090353465e23 affected < e4d3386b74fba8e01280484b67ee481ece00201e
Linux Linux affected
Version Status Constraints
6.6 affected —
0 unaffected < 6.6
6.6.142 unaffected ≤ 6.6.*
6.12.92 unaffected ≤ 6.12.*
6.18.34 unaffected ≤ 6.18.*
7.0.11 unaffected ≤ 7.0.*
7.1 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/41a766c647294842c9b17672449f8e011048cba9 cve-icon
https://git.kernel.org/stable/c/c9f6768515818d71bdfc20119a81f3332c53b9c6 cve-icon
https://git.kernel.org/stable/c/ce836587e594af39ff048d9b29dee0f5f10692c9 cve-icon
https://git.kernel.org/stable/c/e4d3386b74fba8e01280484b67ee481ece00201e cve-icon
https://git.kernel.org/stable/c/feff0251386aa6bb180a0a1cf7c1f91ba868113d cve-icon
https://lore.kernel.org/linux-cve-announce/2026071927-CVE-2026-64134-9e81@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-64134 cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-64134 cve-icon
History

Mon, 20 Jul 2026 14:45:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

 cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Mon, 20 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-476
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Low

Sun, 19 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Don't setup bogus iov_iter for silencing At transition to the iov_iter for PCM data transfer, we blindly applied the iov_iter setup also for silencing (i.e. data = NULL), and it leads to a calculation of bogus iov_iter. Fortunately this didn't cause troubles on most of architectures but it goes wrong on RISC-V now, causing a NULL dereference. Handle the NULL data case to treat the silencing in interleaved_copy() for addressing the bug above. noninterleaved_copy() has already the NULL data handling, so it doesn't need changes.
Title ALSA: pcm: Don't setup bogus iov_iter for silencing
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-07-20T13:43:40.344Z

Reserved: 2026-07-19T07:54:57.036Z

Link: CVE-2026-64134

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

Severity : Low

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-64134 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses