CVE-2026-23076ALSA: ctxfi: Fix potential OOB access in audio mixer handling
- 7.1HighCVSS base score
- 0.18%Exploitation in 30 daysEPSS · top 93% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Fix potential OOB access in audio mixer handling In the audio mixer handling code of ctxfi driver, the conf field is used as a kind of loop index, and it's referred in the index callbacks (amixer_index() and sum_index()). As spotted recently by fuzzers, the current code causes OOB access at those functions. | UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.8/sound/pci/ctxfi/ctamixer.c:347:48 | index 8 is out of range for type 'unsigned char [8]' After the analysis, the cause was found to be the lack of the proper (re-)initialization of conj field. This patch addresses those OOB accesses by adding the proper initializations of the loop indices.
Timeline
ID reserved
By Linux
- 22 days later
· 22 days later
Published
- 9 months later
· 9 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.1 | High7.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.18% · top 93% of all CVEs (13 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.1.
Affected products
- affected 8cc72361481f00253f1e468ade5795427386d593 – < 6524205326e0c1a21263b5c14e48e14ef7e449ae
- affected 8cc72361481f00253f1e468ade5795427386d593 – < afca7ff5d5d4d63a1acb95461f55ca9a729feedf
- affected 8cc72361481f00253f1e468ade5795427386d593 – < 8c1d09806e1441bc6a54b9a4f2818918046d5174
- affected 8cc72361481f00253f1e468ade5795427386d593 – < a8c42d11b0526a89192bd2f79facb4c60c8a1f38
- affected 8cc72361481f00253f1e468ade5795427386d593 – < d77ba72558cd66704f0fb7e0969f697e87c0f71c
- affected 8cc72361481f00253f1e468ade5795427386d593 – < 873e2360d247eeee642878fcc3398babff7e387c
- affected 8cc72361481f00253f1e468ade5795427386d593 – < 61006c540cbdedea83b05577dc7fb7fa18fe1276
- affected 2.6.31
- unaffected < 2.6.31
- unaffected 5.10.249 – ≤ 5.10.*
- unaffected 5.15.199 – ≤ 5.15.*
- unaffected 6.1.162 – ≤ 6.1.*
- unaffected 6.6.122 – ≤ 6.6.*
- unaffected 6.12.68 – ≤ 6.12.*
- unaffected 6.18.8 – ≤ 6.18.*
- unaffected 6.19 – ≤ *
References
References7
- https://git.kernel.org/stable/c/6524205326e0c1a21263b5c14e48e14ef7e449ae (opens in a new tab)
- https://git.kernel.org/stable/c/afca7ff5d5d4d63a1acb95461f55ca9a729feedf (opens in a new tab)
- https://git.kernel.org/stable/c/8c1d09806e1441bc6a54b9a4f2818918046d5174 (opens in a new tab)
- https://git.kernel.org/stable/c/a8c42d11b0526a89192bd2f79facb4c60c8a1f38 (opens in a new tab)
- https://git.kernel.org/stable/c/d77ba72558cd66704f0fb7e0969f697e87c0f71c (opens in a new tab)
- https://git.kernel.org/stable/c/873e2360d247eeee642878fcc3398babff7e387c (opens in a new tab)
- https://git.kernel.org/stable/c/61006c540cbdedea83b05577dc7fb7fa18fe1276 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-5467 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-23076)Record last updated .