Bug 2436826 (CVE-2026-23076) - CVE-2026-23076 kernel: Linux kernel: Denial of Service in ALSA ctxfi driver due to out-of-bounds access
Summary: CVE-2026-23076 kernel: Linux kernel: Denial of Service in ALSA ctxfi driver d...
Keywords:
Status: NEW
Alias: CVE-2026-23076
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-02-04 17:05 UTC by OSIDB Bzimport
Modified: 2026-02-05 15:49 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-02-04 17:05:17 UTC
In the Linux kernel, the following vulnerability has been resolved:

ALSA: ctxfi: Fix potential OOB access in audio mixer handling

In the audio mixer handling code of ctxfi driver, the conf field is
used as a kind of loop index, and it's referred in the index callbacks
(amixer_index() and sum_index()).

As spotted recently by fuzzers, the current code causes OOB access at
those functions.
| UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.8/sound/pci/ctxfi/ctamixer.c:347:48
| index 8 is out of range for type 'unsigned char [8]'

After the analysis, the cause was found to be the lack of the proper
(re-)initialization of conj field.

This patch addresses those OOB accesses by adding the proper
initializations of the loop indices.

Comment 1 Jon Moroney 2026-02-04 19:38:19 UTC Comment hidden (spam)

Note You need to log in before you can comment on or make changes to this bug.