HIGH
alsa PTP OOB
CVE-2026-31602
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.0HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Limit PTP to a single page Commit 391e69143d0a increased CT_PTP_NUM from 1 to 4 to support 256 playback streams, but the additional pages are not used by the card correctly. The CT20K2 hardware already has multiple VMEM_PTPAL registers, but using them separately would require refactoring the entire virtual memory allocation logic. ct_vm_map() always uses PTEs in vm->ptp[0].area regardless of CT_PTP_NUM. On AMD64 systems, a single PTP covers 512 PTEs (2M). When aggregate memory allocations exceed this limit, ct_vm_map() tries to access beyond the allocated space and causes a page fault: BUG: unable to handle page fault for address: ffffd4ae8a10a000 Oops: Oops: 0002 [#1] SMP PTI RIP: 0010:ct_vm_map+0x17c/0x280 [snd_ctxfi] Call Trace: atc_pcm_playback_prepare+0x225/0x3b0 ct_pcm_playback_prepare+0x38/0x60 snd_pcm_do_prepare+0x2f/0x50 snd_pcm_action_single+0x36/0x90 snd_pcm_action_nonatomic+0xbf/0xd0 snd_pcm_ioctl+0x28/0x40 __x64_sys_ioctl+0x97/0xe0 do_syscall_64+0x81/0x610 entry_SYSCALL_64_after_hwframe+0x76/0x7e Revert CT_PTP_NUM to 1. The 256 SRC_RESOURCE_NUM and playback_count remain unchanged.
02KernelScan AI Analysis
Risk summary
Systems with Creative ctxfi audio hardware are vulnerable to kernel memory corruption when applications use PCM playback with high memory allocation. This can lead to system crashes or potential privilege escalation for users with audio device access. Systems enforcing SELinux or AppArmor policies that restrict access to ALSA device nodes may mitigate reachability.
Vulnerability analysis
The vulnerability stems from a mismatch between page table allocation and usage in the ctxfi driver. While CT_PTP_NUM was increased to 4 to support more streams, ct_vm_map() only uses the first page table (ptp[0].area). When memory allocations exceed 512 PTEs (2MB on AMD64), the function writes beyond allocated boundaries, causing a page fault and kernel crash. The fix reverts CT_PTP_NUM to 1, aligning allocation with actual usage patterns.
03Fix Versions
| Branch | Fixed in | Patch commit |
|---|---|---|
| 5.10 | 5.10.258 | c5908160e17c |
| 5.15 | 5.15.209 | de8016fb0904 |
| 6.1 | 6.1.175 | 2b4331c08c0b |
| 6.12 | 6.12.83 | 365c36e1a126 |
| 6.18 | 6.18.24 | 3fd0685d7fef |
| 6.19 | 6.19.14 | b7f5ecd13cce |
| 6.6 | 6.6.136 | 452894005b4a |
| 7.0 | 7.0.1 | ad9011a79540 |
| mainline | 7.1-rc1 | e9418da50d9e |