https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 20:52:45 +0000 https://vulnerability.circl.lu/vuln/cve-2026-90060 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ALSA: control: Don&#39;t add invalid kcontrols to LED layer</p> <p>The kcontrol LED state layer tries to track the all associated kcontrol elements with naive assumptions that they are readable. But one can create a write-only element that has no get callback (even a user element can do it), and this may lead to a NULL dereference at the call chain of snd_ctl_led_notify(), as found by syzkaller.</p> <p>For avoiding the Oops, add a sanity check of the kcontrol&#39;s info and get callbacks, and just skip the invalid kcontrols before assigning the kctl to the LED layer.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ALSA: control: Don&#39;t add invalid kcontrols to LED layer</p> <p>The kcontrol LED state layer tries to track the all associated kcontrol elements with naive assumptions that they are readable. But one can create a write-only element that has no get callback (even a user element can do it), and this may lead to a NULL dereference at the call chain of snd_ctl_led_notify(), as found by syzkaller.</p> <p>For avoiding the Oops, add a sanity check of the kcontrol&#39;s info and get callbacks, and just skip the invalid kcontrols before assigning the kctl to the LED layer.</p> https://vulnerability.circl.lu/vuln/cve-2026-90060