CVE-2026-23076 ALSA: ctxfi: Fix potential OOB access in audio mixer handling
Out-of-bounds access in the ALSA ctxfi audio mixer driver allows attackers to cause denial of service or potentially execute code.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23076?
CVE-2026-23076 is a high-severity memory corruption vulnerability in Linux kernel, published on 4 Feb 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ALSA: ctxfi: Fix potential OOB access in audio mixer handling
In the audio mixer handling code of ctxfi driver, the conf field is used as a kind of loop index, and it's referred in the index callbacks (amixer_index() and sum_index()).
As spotted recently by fuzzers, the current code causes OOB access at those functions. | UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.8/sound/pci/ctxfi/ctamixer.c:347:48 | index 8 is out of range for type 'unsigned char [8]'
After the analysis, the cause was found to be the lack of the proper (re-)initialization of conj field.
This patch addresses those OOB accesses by adding the proper initializations of the loop indices.
Weakness: CWE-125
Which versions are affected by CVE-2026-23076?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-23076?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-23076 being exploited?
There is no known exploitation of CVE-2026-23076 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-77256, BELL-CVE-2026-23076, DEBIAN-CVE-2026-23076, GHSA-9325-8xwg-7r9m, ROOT-OS-DEBIAN-11-CVE-2026-23076, ROOT-OS-DEBIAN-12-CVE-2026-23076 and 4 more.