Bug 2502523 (CVE-2026-64107)

Summary: CVE-2026-64107 kernel: ASoC: codecs: pcm512x: fix null-ptr dereference in pcm512x_overclock_xxx_put()
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Linux kernel's Advanced Linux Sound Architecture (ALSA) System on Chip (ASoC) pcm512x chipset driver. This vulnerability occurs due to incorrect handling of kcontrol definitions, leading to a null-pointer dereference. A local attacker could potentially trigger this flaw, causing the system to crash and resulting in a denial of service.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-19 17:04:08 UTC 
In the Linux kernel, the following vulnerability has been resolved:

ASoC: codecs: pcm512x: fix null-ptr dereference in pcm512x_overclock_xxx_put()

In the pcm512x chipset driver, pcm512x_overclock_xxx_put() is defined as
a general mixer kcontrol instead of a DAPM kcontrol, so struct
snd_soc_dapm_context must not be accessed via
snd_soc_dapm_kcontrol_to_dapm().

This causes a NULL pointer dereference, so it must be modified to use
snd_soc_component_to_dapm().
Comment 1 TEJ RATHI 2026-07-20 12:27:07 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026071921-CVE-2026-64107-2c96@gregkh/T