What is the CVSS score of CVE-2026-64134?

CVE-2026-64134 has a contested CVSS base score of 7.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by CVE-2026-64134?

A Linux kernel vulnerability affecting RISC-V servers can crash systems when local users access sound devices; however, no public exploit identified at time of analysis and a vendor patch is…. A patch is available.

How to fix or mitigate CVE-2026-64134?

Within 24 hours, inventory all RISC-V systems and identify which host shared or untrusted user workloads. Within 7 days, test the vendor-released patch in a RISC-V test environment to ensure compatibility. Within 30 days, deploy the patch to all RISC-V production systems, prioritizing those with untrusted local users.

Linux Kernel CVE-2026-64134

EUVD-2026-45819 HIGH

NULL Pointer Dereference (CWE-476)

2026-07-19 Linux

GHSA-g8p3-wvvx-m6mf

Denial Of Service Linux Null Pointer Dereference

High

Disputed · 7.8 Vendor: Linux

Severity by source

Sources disagree (Low–High)

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

5.5 MEDIUM

Local audio-device access (AV:L, PR:L) with a NULL dereference that crashes the kernel gives A:H; the description shows no data read or modification, so C:N/I:N.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

5.5 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 17:39 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

7.8 (HIGH)

Patch available

Jul 19, 2026 - 17:03 EUVD

CVE Published

Jul 19, 2026 - 15:40 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 19, 2026 - 15:40 cve.org

HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ALSA: pcm: Don't setup bogus iov_iter for silencing

At transition to the iov_iter for PCM data transfer, we blindly applied the iov_iter setup also for silencing (i.e. data = NULL), and it leads to a calculation of bogus iov_iter. Fortunately this didn't cause troubles on most of architectures but it goes wrong on RISC-V now, causing a NULL dereference.

Handle the NULL data case to treat the silencing in interleaved_copy() for addressing the bug above. noninterleaved_copy() has already the NULL data handling, so it doesn't need changes.

AnalysisAI

Denial of service in the Linux kernel ALSA PCM subsystem allows a local low-privileged user with sound-device access to crash the system on RISC-V hardware. During the transition to iov_iter for PCM data transfer, the silencing path (data = NULL) reused the interleaved iov_iter setup, producing a bogus iterator that triggers a NULL pointer dereference; on most other architectures it was benign, but RISC-V faults. No public exploit is identified at time of analysis, and EPSS risk is low at 0.17% (6th percentile). The kernel tags flag potential information disclosure, though the concretely described symptom is a crash.

Technical ContextAI

The flaw lives in the ALSA (Advanced Linux Sound Architecture) PCM core, specifically interleaved_copy() in the sound/core/pcm code path that moves audio frames between user and kernel buffers. A refactor migrated PCM data transfer to the kernel's iov_iter abstraction but applied the same iov_iter construction to the 'silencing' operation, which passes data = NULL to fill a buffer with silence rather than copying real user data. With a NULL source, the length/base math produces an invalid iov_iter and the subsequent access dereferences NULL. This is effectively an improper NULL/pointer handling bug (CWE-476 class, though CWE is unlisted in the feed); noninterleaved_copy() already special-cased NULL data and was unaffected. The affected component is the mainline Linux kernel (cpe:2.3:a:linux:linux), and the fault surfaces on RISC-V due to differing memory-access behavior versus x86/ARM.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 6.6.142, 6.12.92, 6.18.34, 7.0.11, or 7.1 (or later), whichever matches your branch. The upstream fix adds NULL-data handling to interleaved_copy() so the silencing path no longer builds a bogus iov_iter; corresponding stable commits are 41a766c647294842c9b17672449f8e011048cba9, ce836587e594af39ff048d9b29dee0f5f10692c9, feff0251386aa6bb180a0a1cf7c1f91ba868113d, c9f6768515818d71bdfc20119a81f3332c53b9c6, and e4d3386b74fba8e01280484b67ee481ece00201e (git.kernel.org/stable/c/<hash>). If immediate kernel upgrade is not possible, restrict access to ALSA PCM devices by tightening permissions on /dev/snd/* (e.g. remove untrusted users from the 'audio' group), which prevents unprivileged triggering at the cost of blocking legitimate local audio for those users; on servers without an audio workload, blacklisting/unloading snd_pcm and related sound modules removes the attack surface entirely with no functional trade-off. These controls are most relevant on RISC-V deployments where the crash is confirmed.

Same weakness CWE-476 – NULL Pointer Dereference

View all

CVE-2016-0742 HIGH

7.5

CVE-2014-3470 MEDIUM

4.3

CVE-2017-3730 HIGH POC

7.5

CVE-2017-3169 CRITICAL POC

9.8

CVE-2016-4957 HIGH

7.5

CVE-2015-3194 HIGH

7.5

CVE-2026-21525 MEDIUM

6.2

CVE-2017-0016 MEDIUM

5.9

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-64134 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-64134

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-476 – NULL Pointer Dereference

Same technique Denial Of Service

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code