CVE-2026-23076

HighCVSS 7.1/10Last modified Oct 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: ctxfi: Fix potential OOB access in audio mixer handling

In the audio mixer handling code of ctxfi driver, the conf field is used as a kind of loop index, and it's referred in the index callbacks (amixer_index() and sum_index()).

As spotted recently by fuzzers, the current code causes OOB access at those functions. | UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.8/sound/pci/ctxfi/ctamixer.c:347:48 | index 8 is out of range for type 'unsigned char [8]'

After the analysis, the cause was found to be the lack of the proper (re-)initialization of conj field.

This patch addresses those OOB accesses by adding the proper initializations of the loop indices.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-125

Affected software

VendorProductVersions
LinuxLinux>= 8cc72361481f00253f1e468ade5795427386d593, < 6524205326e0c1a21263b5c14e48e14ef7e449ae; >= 8cc72361481f00253f1e468ade5795427386d593, < afca7ff5d5d4d63a1acb95461f55ca9a729feedf; >= 8cc72361481f00253f1e468ade5795427386d593, < 8c1d09806e1441bc6a54b9a4f2818918046d5174; >= 8cc72361481f00253f1e468ade5795427386d593, < a8c42d11b0526a89192bd2f79facb4c60c8a1f38; >= 8cc72361481f00253f1e468ade5795427386d593, < d77ba72558cd66704f0fb7e0969f697e87c0f71c; >= 8cc72361481f00253f1e468ade5795427386d593, < 873e2360d247eeee642878fcc3398babff7e387c; >= 8cc72361481f00253f1e468ade5795427386d593, < 61006c540cbdedea83b05577dc7fb7fa18fe1276
LinuxLinux2.6.31

References

Timeline

Published
Feb 4, 2026
Last modified
Oct 19, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-230777.8In the Linux kernel, the following vulnerability has been resolved: mm/vma: fix anon_vma UAF on mremap() faulted, unfaulted merge Patch seCVE-2026-230787.8In the Linux kernel, the following vulnerability has been resolved: ALSA: scarlett2: Fix buffer overflow in config retrieval The scarlett2CVE-2026-230795.5In the Linux kernel, the following vulnerability has been resolved: gpio: cdev: Fix resource leaks on errors in lineinfo_changed_notify() CVE-2026-230805.5In the Linux kernel, the following vulnerability has been resolved: can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak Fix CVE-2026-230815.5In the Linux kernel, the following vulnerability has been resolved: net: phy: intel-xway: fix OF node refcount leakage Automated review spCVE-2026-230825.5In the Linux kernel, the following vulnerability has been resolved: can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submitCVE-2026-230837.8In the Linux kernel, the following vulnerability has been resolved: fou: Don't allow 0 for FOU_ATTR_IPPROTO. fou_udp_recv() has the same pCVE-2026-230845.5In the Linux kernel, the following vulnerability has been resolved: be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list When CVE-2026-230855.5In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Avoid truncating memory addresses On 32-bit machinCVE-2026-230865.5In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: cap TX credit to local buffer size The virtio transportsCVE-2026-230875.5In the Linux kernel, the following vulnerability has been resolved: scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() MeCVE-2026-230885.5In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash on synthetic stacktrace field usage When creating a
CVE-2026-23076: High severity, CVSS 7.1 | Vulnix