High 7.8Published Apr 24, 2026

CVE-2026-31602ALSA: ctxfi: Limit PTP to a single page

Updated under an hour ago (Oct 27, 2026, 7:40 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Limit PTP to a single page Commit 391e69143d0a increased CT_PTP_NUM from 1 to 4 to support 256 playback streams, but the additional pages are not used by the card correctly. The CT20K2 hardware already has multiple VMEM_PTPAL registers, but using them separately would require refactoring the entire virtual memory allocation logic. ct_vm_map() always uses PTEs in vm->ptp[0].area regardless of CT_PTP_NUM. On AMD64 systems, a single PTP covers 512 PTEs (2M). When aggregate memory allocations exceed this limit, ct_vm_map() tries to access beyond the allocated space and causes a page fault: BUG: unable to handle page fault for address: ffffd4ae8a10a000 Oops: Oops: 0002 [#1] SMP PTI RIP: 0010:ct_vm_map+0x17c/0x280 [snd_ctxfi] Call Trace: atc_pcm_playback_prepare+0x225/0x3b0 ct_pcm_playback_prepare+0x38/0x60 snd_pcm_do_prepare+0x2f/0x50 snd_pcm_action_single+0x36/0x90 snd_pcm_action_nonatomic+0xbf/0xd0 snd_pcm_ioctl+0x28/0x40 __x64_sys_ioctl+0x97/0xe0 do_syscall_64+0x81/0x610 entry_SYSCALL_64_after_hwframe+0x76/0x7e Revert CT_PTP_NUM to 1. The 256 SRC_RESOURCE_NUM and playback_count remain unchanged.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Aug 5, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 391e69143d0a05f960e3ab39a8c26b7b230bb8a9 before c5908160e17cb56e1f61fbaee08adc21083f4933; from 391e69143d0a05f960e3ab39a8c26b7b230bb8a9 before de8016fb0904d68ac886e375069535996baa42ee; 391e69143d0a05f960e3ab39a8c26b7b230bb8a9 builds before 2b4331c08c0b385598b4d8ccd71e93ab3f4b2578; from 391e69143d0a05f960e3ab39a8c26b7b230bb8a9 before 452894005b4abe141b11fe01e7bfe152e6d3860f; 391e69143d0a05f960e3ab39a8c26b7b230bb8a9 builds before 365c36e1a126c6aa1aecedd3a351bcabc66f0c29; 391e69143d0a05f960e3ab39a8c26b7b230bb8a9 builds before 3fd0685d7fef68c2d8a04876bcf9eaa0724ad6a5; from 391e69143d0a05f960e3ab39a8c26b7b230bb8a9 before b7f5ecd13cce8c2f8fa5a84c9aab65997142577e; from 391e69143d0a05f960e3ab39a8c26b7b230bb8a9 before ad9011a795407093dcf507f6e5da1828987b4b47; and 1 more ranges	CNA record
linux linux_kernel linux:linux_kernel	from 3.2 before 6.6.136; from 6.7 before 6.12.83; from 6.13 before 6.18.24; from 6.19 before 6.19.14; from 7.0 before 7.0.1	NVD

References

References

https://git.kernel.org/stable/c/c5908160e17cb56e1f61fbaee08adc21083f4933
https://git.kernel.org/stable/c/de8016fb0904d68ac886e375069535996baa42ee
https://git.kernel.org/stable/c/2b4331c08c0b385598b4d8ccd71e93ab3f4b2578
https://git.kernel.org/stable/c/452894005b4abe141b11fe01e7bfe152e6d3860f	patch
https://git.kernel.org/stable/c/365c36e1a126c6aa1aecedd3a351bcabc66f0c29	patch
https://git.kernel.org/stable/c/3fd0685d7fef68c2d8a04876bcf9eaa0724ad6a5	patch
https://git.kernel.org/stable/c/b7f5ecd13cce8c2f8fa5a84c9aab65997142577e	patch
https://git.kernel.org/stable/c/ad9011a795407093dcf507f6e5da1828987b4b47	patch
https://git.kernel.org/stable/c/e9418da50d9e5c496c22fe392e4ad74c038a94eb	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.