CVE-2026-97418
kernel: ALSA: es18xx: check control allocation before private data setup
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · September 24, 2026
Updated · September 29, 2026
Description
A flaw was found in the Linux kernel's ALSA (Advanced Linux Sound Architecture) subsystem within the ESS AudioDrive ES18xx sound card driver. During mixer initialization, the driver fails to verify whether memory allocation for sound control structures succeeds before dereferencing the returned pointer. A local user could trigger this vulnerability under low-memory conditions, resulting in a NULL pointer dereference that causes a kernel crash and a Denial of Service (DoS).
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 · NULL Pointer Dereference