{"id":"CVE-2026-23076","revision":"7844b0ab01144ed98210613b650d8771","records":[{"revision":"7844b0ab01144ed98210613b650d8771","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-23076","aliases":[],"title":"ALSA: ctxfi: Fix potential OOB access in audio mixer handling","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: ctxfi: Fix potential OOB access in audio mixer handling\n\nIn the audio mixer handling code of ctxfi driver, the conf field is\nused as a kind of loop index, and it's referred in the index callbacks\n(amixer_index() and sum_index()).\n\nAs spotted recently by fuzzers, the current code causes OOB access at\nthose functions.\n| UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.8/sound/pci/ctxfi/ctamixer.c:347:48\n| index 8 is out of range for type 'unsigned char [8]'\n\nAfter the analysis, the cause was found to be the lack of the proper\n(re-)initialization of conj field.\n\nThis patch addresses those OOB accesses by adding the proper\ninitializations of the loop indices.","state":0,"publishedAt":"2026-02-04T16:08:01.204+00:00","modifiedAt":"2026-10-19T18:25:29.498+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"sound/pci/ctxfi/ctamixer.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"8cc72361481f00253f1e468ade5795427386d593\",\n                            \"lessThan\": \"6524205326e0c1a21263b5c14e48e14ef7e449ae\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8cc72361481f00253f1e468ade5795427386d593\",\n                            \"lessThan\": \"afca7ff5d5d4d63a1acb95461f55ca9a729feedf\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8cc72361481f00253f1e468ade5795427386d593\",\n                            \"lessThan\": \"8c1d09806e1441bc6a54b9a4f2818918046d5174\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8cc72361481f00253f1e468ade5795427386d593\",\n                            \"lessThan\": \"a8c42d11b0526a89192bd2f79facb4c60c8a1f38\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8cc72361481f00253f1e468ade5795427386d593\",\n                            \"lessThan\": \"d77ba72558cd66704f0fb7e0969f697e87c0f71c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8cc72361481f00253f1e468ade5795427386d593\",\n                            \"lessThan\": \"873e2360d247eeee642878fcc3398babff7e387c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8cc72361481f00253f1e468ade5795427386d593\",\n                            \"lessThan\": \"61006c540cbdedea83b05577dc7fb7fa18fe1276\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"sound/pci/ctxfi/ctamixer.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"2.6.31\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"2.6.31\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.249\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.199\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.162\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.122\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.68\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.8\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.19\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/6524205326e0c1a21263b5c14e48e14ef7e449ae","https://git.kernel.org/stable/c/afca7ff5d5d4d63a1acb95461f55ca9a729feedf","https://git.kernel.org/stable/c/8c1d09806e1441bc6a54b9a4f2818918046d5174","https://git.kernel.org/stable/c/a8c42d11b0526a89192bd2f79facb4c60c8a1f38","https://git.kernel.org/stable/c/d77ba72558cd66704f0fb7e0969f697e87c0f71c","https://git.kernel.org/stable/c/873e2360d247eeee642878fcc3398babff7e387c","https://git.kernel.org/stable/c/61006c540cbdedea83b05577dc7fb7fa18fe1276"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-23076","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-23076","identifiers":["CVE-2026-23076"]},"retained":false,"historicalAffected":[]}],"coverage":[]}