CVE-2026-23076 Details
Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Fix potential OOB access in audio mixer handling In the audio mixer handling code of ctxfi driver, the conf field is used as a kind of loop index, and it's referred in the index callbacks (amixer_index() and sum_index()). As spotted recently by fuzzers, the current code causes OOB access at those functions. | UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.8/sound/pci/ctxfi/ctamixer.c:347:48 | index 8 is out of range for type 'unsigned char [8]' After the analysis, the cause was found to be the lack of the proper (re-)initialization of conj field. This patch addresses those OOB accesses by adding the proper initializations of the loop indices.
A vulnerability allowing out-of-bounds access has been identified in the audio mixer handling of the ALSA ctxfi driver within the Linux kernel. This issue arises because the 'conf' field is improperly used as a loop index, leading to out-of-bounds access in the 'amixer_index()' and 'sum_index()' callback functions. Fuzzing efforts revealed that the current implementation allows an index value of 8, which exceeds the valid range for an unsigned char array of size 8. The root cause was traced to the 'conj' field not being correctly initialized. This vulnerability affects Linux kernel versions prior to 6.17.9.
Users can upgrade to Linux kernel version 6.17.9 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/61006c540cbdedea83b05577dc7fb7fa18fe1276 | kernel.org | Patch |
| https://git.kernel.org/stable/c/6524205326e0c1a21263b5c14e48e14ef7e449ae | kernel.org | Patch |
| https://git.kernel.org/stable/c/873e2360d247eeee642878fcc3398babff7e387c | kernel.org | Patch |
| https://git.kernel.org/stable/c/8c1d09806e1441bc6a54b9a4f2818918046d5174 | kernel.org | Patch |
| https://git.kernel.org/stable/c/a8c42d11b0526a89192bd2f79facb4c60c8a1f38 | kernel.org | Patch |
| https://git.kernel.org/stable/c/afca7ff5d5d4d63a1acb95461f55ca9a729feedf | kernel.org | Patch |
| https://git.kernel.org/stable/c/d77ba72558cd66704f0fb7e0969f697e87c0f71c | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 2.6.31, < 5.10.249 >= 5.11, < 5.15.199 >= 5.16, < 6.1.162 >= 6.2, < 6.6.122 >= 6.7, < 6.12.68 >= 6.13, < 6.18.8 6.19 rc1 6.19 rc2 6.19 rc3 6.19 rc4 6.19 rc5 6.19 rc6 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 18, 2026 | Initial Analysis | [email protected] |
| Feb 6, 2026 | CVE Modified | kernel.org |
| Feb 4, 2026 | New CVE Received | kernel.org |