CVE-2026-23076

A flaw was found in the Linux kernel's ALSA (Advanced Linux Sound Architecture) ctxfi driver. A local user with access to the sound device and ALSA control interfaces can exploit this out-of-bounds memory access vulnerability by exercising mixer controls. This issue stems from the improper re-initialization of a loop index field, which can cause the system to access memory outside of its allocated bounds. Successful exploitation can lead to a kernel crash or unstable system behavior, resulting in a Denial of Service (DoS).

An out of bounds access can occur in the ALSA ctxfi mixer code because the rsc.conj field is used as a loop index in amixer_index and sum_index. The driver did not reliably reinitialize conj when setting up amixer and sum resources. If conj retains a stale value, the index callbacks can use it to access fixed size arrays out of range, which was observed by fuzzers and reported by UBSAN as an array index out of bounds. The issue is reachable through normal mixer control handling once the ctxfi driver is loaded. A local user with access to the sound device and ALSA control interfaces can trigger the relevant paths by exercising mixer controls. For the CVSS the PR is L because access to ALSA control devices is typically mediated by local permissions and group membership. The primary impact is availability because an out of bounds access in kernel space can crash the kernel or lead to unstable behavior.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.