Linux Kernel CVE-2026-64107

Exploitation requires all of the following: (1) a local user account with at least low privileges (PR:L per CVSS:3.1/PR:L); (2) the target system must physically have a PCM512x-based audio codec and the snd_soc_pcm512x kernel module must be loaded - systems without this hardware are entirely unaffected; (3) the user must have write permission to ALSA mixer kcontrols on the PCM512x device, which typically requires membership in the 'audio' group or equivalent ACL on /dev/snd/* device nodes. No network access is involved. Limiting factors are hardware specificity (PCM512x DAC required), local-only access vector, and the need for ALSA group membership, all of which substantially reduce the realistic exposed population beyond what the raw CVSS availability impact implies.

CVSS 5.5 Medium (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) accurately characterises this as a local, low-complexity denial-of-service with no confidentiality or integrity impact. The EPSS probability of 0.16% at the 6th percentile corroborates the low exploitation likelihood - this is a hardware-specific driver bug rather than a broadly reachable attack surface. The vulnerability is absent from CISA KEV and no public exploit or proof-of-concept has been identified, making active exploitation implausible in the near term. Real-world risk is further bounded by the prerequisite of PCM512x audio hardware being present and the snd_soc_pcm512x module loaded, which limits the exposed population to embedded audio systems, single-board computers, and specialised audio workstations. There is no conflict between the CVSS signals and the description; the local vector and hardware specificity are fully consistent. This is a low operational priority for general-purpose servers and desktops, rising in relevance only for audio-focused embedded Linux deployments.

A local user on a Linux system equipped with a PCM512x DAC (common on Raspberry Pi HATs and embedded audio boards) uses the amixer utility or an ALSA application to write to one of the PCM512x overclocking mixer kcontrols. The kernel invokes pcm512x_overclock_xxx_put(), which dereferences the NULL pointer returned by snd_soc_dapm_kcontrol_to_dapm(), immediately triggering a kernel panic and system crash. No public exploit code has been identified; the attack requires only standard ALSA mixer write access and knowledge of the affected kcontrol name.