CVE-2026-31602 ALSA: ctxfi: Limit PTP to a single page

High 7.8 Published 24 Apr 2026 Updated 5 Aug 2026

A local attacker can trigger a kernel page fault and system crash by exceeding memory limits in the ALSA ctxfi driver.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-31602?

CVE-2026-31602 is a high-severity memory corruption vulnerability in Linux kernel, published on 24 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: ctxfi: Limit PTP to a single page

Commit 391e69143d0a increased CT_PTP_NUM from 1 to 4 to support 256 playback streams, but the additional pages are not used by the card correctly. The CT20K2 hardware already has multiple VMEM_PTPAL registers, but using them separately would require refactoring the entire virtual memory allocation logic.

ct_vm_map() always uses PTEs in vm->ptp[0].area regardless of CT_PTP_NUM. On AMD64 systems, a single PTP covers 512 PTEs (2M). When aggregate memory allocations exceed this limit, ct_vm_map() tries to access beyond the allocated space and causes a page fault:

BUG: unable to handle page fault for address: ffffd4ae8a10a000 Oops: Oops: 0002 [#1] SMP PTI RIP: 0010:ct_vm_map+0x17c/0x280 [snd_ctxfi] Call Trace: atc_pcm_playback_prepare+0x225/0x3b0 ct_pcm_playback_prepare+0x38/0x60 snd_pcm_do_prepare+0x2f/0x50 snd_pcm_action_single+0x36/0x90 snd_pcm_action_nonatomic+0xbf/0xd0 snd_pcm_ioctl+0x28/0x40 __x64_sys_ioctl+0x97/0xe0 do_syscall_64+0x81/0x610 entry_SYSCALL_64_after_hwframe+0x76/0x7e

Revert CT_PTP_NUM to 1. The 256 SRC_RESOURCE_NUM and playback_count remain unchanged.

Which versions are affected by CVE-2026-31602?

It affects 1 product.

Products include Linux kernel.

How do I fix CVE-2026-31602?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-31602 being exploited?

There is no known exploitation of CVE-2026-31602 in the wild and no public exploit code.

All Linux kernel vulnerabilities

Sources

Also known as BELL-CVE-2026-31602, DEBIAN-CVE-2026-31602, GHSA-426x-jc5h-fmgg, ROOT-OS-DEBIAN-11-CVE-2026-31602, ROOT-OS-DEBIAN-12-CVE-2026-31602, ROOT-OS-UBUNTU-2204-CVE-2026-31602 and 2 more.