---
id: CVE-2026-23076
title: 'ALSA: ctxfi: Fix potential OOB access in audio mixer handling'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ALSA: ctxfi: Fix potential OOB access in audio mixer handling

  In the audio mixer handling code of ctxfi driver, the conf field is
  used as a kind of loop index, and it'…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 8cc72361481f00253f1e468ade5795427386d593 <
    6524205326e0c1a21263b5c14e48e14ef7e449ae
  - >-
    Linux >= 8cc72361481f00253f1e468ade5795427386d593 <
    afca7ff5d5d4d63a1acb95461f55ca9a729feedf
  - >-
    Linux >= 8cc72361481f00253f1e468ade5795427386d593 <
    8c1d09806e1441bc6a54b9a4f2818918046d5174
  - >-
    Linux >= 8cc72361481f00253f1e468ade5795427386d593 <
    a8c42d11b0526a89192bd2f79facb4c60c8a1f38
  - >-
    Linux >= 8cc72361481f00253f1e468ade5795427386d593 <
    d77ba72558cd66704f0fb7e0969f697e87c0f71c
  - >-
    Linux >= 8cc72361481f00253f1e468ade5795427386d593 <
    873e2360d247eeee642878fcc3398babff7e387c
  - >-
    Linux >= 8cc72361481f00253f1e468ade5795427386d593 <
    61006c540cbdedea83b05577dc7fb7fa18fe1276
  - Linux 2.6.31
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-06-10T20:42:28.584114Z'
published: '2026-02-04'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T18:25:29.498Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-23076'
references:
  - url: 'https://git.kernel.org/stable/c/6524205326e0c1a21263b5c14e48e14ef7e449ae'
  - url: 'https://git.kernel.org/stable/c/afca7ff5d5d4d63a1acb95461f55ca9a729feedf'
  - url: 'https://git.kernel.org/stable/c/8c1d09806e1441bc6a54b9a4f2818918046d5174'
  - url: 'https://git.kernel.org/stable/c/a8c42d11b0526a89192bd2f79facb4c60c8a1f38'
  - url: 'https://git.kernel.org/stable/c/d77ba72558cd66704f0fb7e0969f697e87c0f71c'
  - url: 'https://git.kernel.org/stable/c/873e2360d247eeee642878fcc3398babff7e387c'
  - url: 'https://git.kernel.org/stable/c/61006c540cbdedea83b05577dc7fb7fa18fe1276'
tags:
  - cve.org
epss: 0.00148
epssPercentile: 0.03591
ingestedAt: '2026-10-19T18:35:50.107Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ALSA: ctxfi: Fix potential OOB access in audio mixer handling

In the audio mixer handling code of ctxfi driver, the conf field is
used as a kind of loop index, and it's referred in the index callbacks
(amixer_index() and sum_index()).

As spotted recently by fuzzers, the current code causes OOB access at
those functions.
| UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.8/sound/pci/ctxfi/ctamixer.c:347:48
| index 8 is out of range for type 'unsigned char [8]'

After the analysis, the cause was found to be the lack of the proper
(re-)initialization of conj field.

This patch addresses those OOB accesses by adding the proper
initializations of the loop indices.

## Affected

- `Linux >= 8cc72361481f00253f1e468ade5795427386d593 < 6524205326e0c1a21263b5c14e48e14ef7e449ae`
- `Linux >= 8cc72361481f00253f1e468ade5795427386d593 < afca7ff5d5d4d63a1acb95461f55ca9a729feedf`
- `Linux >= 8cc72361481f00253f1e468ade5795427386d593 < 8c1d09806e1441bc6a54b9a4f2818918046d5174`
- `Linux >= 8cc72361481f00253f1e468ade5795427386d593 < a8c42d11b0526a89192bd2f79facb4c60c8a1f38`
- `Linux >= 8cc72361481f00253f1e468ade5795427386d593 < d77ba72558cd66704f0fb7e0969f697e87c0f71c`
- `Linux >= 8cc72361481f00253f1e468ade5795427386d593 < 873e2360d247eeee642878fcc3398babff7e387c`
- `Linux >= 8cc72361481f00253f1e468ade5795427386d593 < 61006c540cbdedea83b05577dc7fb7fa18fe1276`
- `Linux 2.6.31`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.