CVE-2026-23076None▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Fix potential OOB access in audio mixer handling In the audio mixer handling code of ctxfi driver, the conf field is used as a kind of loop index, and it'…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.1%
0.1% → 0.2%
In the Linux kernel, the following vulnerability has been resolved:
ALSA: ctxfi: Fix potential OOB access in audio mixer handling
In the audio mixer handling code of ctxfi driver, the conf field is used as a kind of loop index, and it's referred in the index callbacks (amixer_index() and sum_index()).
As spotted recently by fuzzers, the current code causes OOB access at those functions. | UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.8/sound/pci/ctxfi/ctamixer.c:347:48 | index 8 is out of range for type 'unsigned char [8]'
After the analysis, the cause was found to be the lack of the proper (re-)initialization of conj field.
This patch addresses those OOB accesses by adding the proper initializations of the loop indices.
Linux >= 8cc72361481f00253f1e468ade5795427386d593 < 6524205326e0c1a21263b5c14e48e14ef7e449aeLinux >= 8cc72361481f00253f1e468ade5795427386d593 < afca7ff5d5d4d63a1acb95461f55ca9a729feedfLinux >= 8cc72361481f00253f1e468ade5795427386d593 < 8c1d09806e1441bc6a54b9a4f2818918046d5174Linux >= 8cc72361481f00253f1e468ade5795427386d593 < a8c42d11b0526a89192bd2f79facb4c60c8a1f38Linux >= 8cc72361481f00253f1e468ade5795427386d593 < d77ba72558cd66704f0fb7e0969f697e87c0f71cLinux >= 8cc72361481f00253f1e468ade5795427386d593 < 873e2360d247eeee642878fcc3398babff7e387cLinux >= 8cc72361481f00253f1e468ade5795427386d593 < 61006c540cbdedea83b05577dc7fb7fa18fe1276Linux 2.6.31Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-99118Nonedrm/i915/dmc: Harden DMC firmware payload parsing
CVE-2026-99117Nonenet: bridge: mcast: don't truncate the port group walk on teardown
CVE-2026-99121Noneipv4: avoid divide by zero in fib_rebalance
CVE-2026-99120NoneKVM: x86/mmu: Cope with the SS bit being set in #NPF exit codes
CVE-2026-99119Nonedrm/amdgpu/userq: actually validate userq BOs
CVE-2026-99123Nonevsock/virtio: validate packet source for connected sockets