rootpwn

medium · CVSS v3 5.5

CVE-2026-97418

The CVE-2026-97418 flaw in the Linux kernel’s ALSA es18xx driver allows a NULL pointer dereference during control allocation. It occurs when

Overview

The CVE-2026-97418 flaw in the Linux kernel’s ALSA es18xx driver allows a NULL pointer dereference during control allocation. It occurs when snd_ctl_new1() fails but the driver still writes to the returned pointer before adding the control. This can lead to a kernel crash or denial of service on affected systems.

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: es18xx: check control allocation before private data setup snd_es18xx_mixer() creates controls with snd_ctl_new1() and then stores bookkeeping pointers or sets private_free before calling snd_ctl_add(). snd_ctl_new1() can return NULL on allocation failure, so those writes can dereference a NULL control pointer. Check the returned control pointers before using them and return -ENOMEM on allocation failure.

Impact

The vulnerability compromises the integrity and availability of the kernel, potentially causing system crashes or service interruptions. It does not directly affect confidentiality or enable remote code execution. Defenders should be aware that the flaw can be triggered by any process that interacts with the ALSA es18xx controls, such as audio applications or drivers.

Remediation

Apply the official kernel patch that checks the return value of snd_ctl_new1() before using the control pointer and returns -ENOMEM on failure. If a patch is not yet available, disable or remove the es18xx driver from the kernel configuration and monitor for kernel panics related to ALSA control creation.

Risk context

The vulnerability has a medium severity (CVSS v3 5.5) and no EPSS data is available. It poses a moderate risk of denial of service but is unlikely to be exploited remotely. Defenders should treat it as a low to medium priority update.

Affected products

  • Linux kernel
  • ALSA es18xx driver

Scores

Severity
medium
CVSS v2
4.9
CVSS v3
5.5
CVSS v4
—
EPSS
—

Linux ALSA kernel NULL-pointer medium CVE-2026-97418

← All CVEs

Related CVEs

medium

CVE-2026-93285

In the Linux kernel, the following vulnerability has been resolved: f2fs: embed f2fs_gc_kthread in f2fs_sb_info Instead of allocating f2fs_gc_kthread dynamically, embed it in f2fs_sb_info. This simplifies lifetime management and prepares for fixing race conditions during teardown. - __sbi_store - remount|shutdown - f2fs_stop_gc_thread - access sbi->gc_thread - sbi->gc_thread = NULL - access sbi->gc_thread->f2fs_gc_task

View analysis

medium

CVE-2026-93286

This CVE addresses a NULL pointer dereference in the Linux kernel's AppleTalk implementation. The flaw occurs when a device without an AppleTalk interface invokes aarp_send_ddp, potentially causing a kernel crash. It matters because it can lead to denial of service on affected systems.

View analysis

medium

CVE-2026-93781

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Do not block on tag allocation in scsi_eh_lock_door() scsi_eh_lock_door() is called from scsi_restart_operations() while the host is still in the SHOST_RECOVERY state, i.e. before the host is switched back to SHOST_RUNNING and scsi_run_host_queues() restarts the queues. It allocates a request via scsi_alloc_request() with no flags, so blk_mq_get_tag() may block waiting for a free sched tag when all tags are already in use. Those tags can be held by commands that were just requeued by scsi_eh_flush_done_q() during error handling. Such commands cannot be dispatched until the host leaves SHOST_RECOVERY and scsi_run_host_queues() is called - which only happens *after* scsi_eh_lock_door() returns. This forms a circular dependency: - scsi_eh_lock_door(), running in the SCSI error handler thread, waits for a sched tag held by a requeued command; - the requeued command cannot complete and release its sched tag until the error handler thread leaves scsi_restart_operations() and restart the queues. For devices with a single driver tag (e.g. USB storage) it is a guaranteed deadlock and I/O that can never be submitted. This problem has also been reproduced in our environment. Locking the door is a best-effort operation, and scsi_eh_lock_door() already returns silently when the request allocation fails. Pass BLK_MQ_REQ_NOWAIT to scsi_alloc_request() so the allocation fails instead of blocking when no tag is available. This breaks the circular dependency and allows the error handler to finish restarting the queues, after which the pending commands are dispatched normally.

View analysis

medium

CVE-2026-93786

In the Linux kernel, the following vulnerability has been resolved: ksmbd: preserve VFS inherited POSIX ACL mask The VFS initializes a child's POSIX ACL from the parent's default ACL and the requested creation mode. Do not mutate the parent ACL or overwrite the child's VFS-computed access and default ACLs afterwards. This preserves restrictive ACL_MASK entries and prevents SMB object creation from widening effective permissions.

View analysis