High 7.1Published Feb 4, 2026

CVE-2026-23076ALSA: ctxfi: Fix potential OOB access in audio mixer handling

Updated under an hour ago (Oct 27, 2026, 5:10 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Fix potential OOB access in audio mixer handling In the audio mixer handling code of ctxfi driver, the conf field is used as a kind of loop index, and it's referred in the index callbacks (amixer_index() and sum_index()). As spotted recently by fuzzers, the current code causes OOB access at those functions. | UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.8/sound/pci/ctxfi/ctamixer.c:347:48 | index 8 is out of range for type 'unsigned char [8]' After the analysis, the cause was found to be the lack of the proper (re-)initialization of conj field. This patch addresses those OOB accesses by adding the proper initializations of the loop indices.

CVSS: 7.1 HIGH (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Weakness (CWE): CWE-125
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 8cc72361481f00253f1e468ade5795427386d593 before 6524205326e0c1a21263b5c14e48e14ef7e449ae; from 8cc72361481f00253f1e468ade5795427386d593 before afca7ff5d5d4d63a1acb95461f55ca9a729feedf; 8cc72361481f00253f1e468ade5795427386d593 builds before 8c1d09806e1441bc6a54b9a4f2818918046d5174; from 8cc72361481f00253f1e468ade5795427386d593 before a8c42d11b0526a89192bd2f79facb4c60c8a1f38; from 8cc72361481f00253f1e468ade5795427386d593 before d77ba72558cd66704f0fb7e0969f697e87c0f71c; from 8cc72361481f00253f1e468ade5795427386d593 before 873e2360d247eeee642878fcc3398babff7e387c; from 8cc72361481f00253f1e468ade5795427386d593 before 61006c540cbdedea83b05577dc7fb7fa18fe1276	CNA record
linux linux_kernel linux:linux_kernel	from 2.6.31 before 5.10.249; from 5.11 before 5.15.199; from 5.16 before 6.1.162; from 6.2 before 6.6.122; from 6.7 before 6.12.68; from 6.13 before 6.18.8; 6.19; 6.19; and 4 more ranges	NVD

References

References

https://git.kernel.org/stable/c/6524205326e0c1a21263b5c14e48e14ef7e449ae	patch
https://git.kernel.org/stable/c/afca7ff5d5d4d63a1acb95461f55ca9a729feedf	patch
https://git.kernel.org/stable/c/8c1d09806e1441bc6a54b9a4f2818918046d5174	patch
https://git.kernel.org/stable/c/a8c42d11b0526a89192bd2f79facb4c60c8a1f38	patch
https://git.kernel.org/stable/c/d77ba72558cd66704f0fb7e0969f697e87c0f71c	patch
https://git.kernel.org/stable/c/873e2360d247eeee642878fcc3398babff7e387c	patch
https://git.kernel.org/stable/c/61006c540cbdedea83b05577dc7fb7fa18fe1276	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.