Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-31602— ALSA: ctxfi: Limit PTP to a single page

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于ALSA ctxfi驱动CT_PTP_NUM增加后未正确使用额外页面，ct_vm_map()访问超出分配空间导致页错误。

CVSS 7.8 · High EPSS 0.18% · P7

Possible ATT&CK Techniques 1 AI

T1203 · Exploitation for Client Execution

Affected Version Matrix 20

VendorProduct Version RangeStatus
Linux Linux 391e69143d0a05f960e3ab39a8c26b7b230bb8a9< c5908160e17cb56e1f61fbaee08adc21083f4933 affected
391e69143d0a05f960e3ab39a8c26b7b230bb8a9< de8016fb0904d68ac886e375069535996baa42ee affected
391e69143d0a05f960e3ab39a8c26b7b230bb8a9< 2b4331c08c0b385598b4d8ccd71e93ab3f4b2578 affected
391e69143d0a05f960e3ab39a8c26b7b230bb8a9< 452894005b4abe141b11fe01e7bfe152e6d3860f affected
391e69143d0a05f960e3ab39a8c26b7b230bb8a9< 365c36e1a126c6aa1aecedd3a351bcabc66f0c29 affected
391e69143d0a05f960e3ab39a8c26b7b230bb8a9< 3fd0685d7fef68c2d8a04876bcf9eaa0724ad6a5 affected
391e69143d0a05f960e3ab39a8c26b7b230bb8a9< b7f5ecd13cce8c2f8fa5a84c9aab65997142577e affected
391e69143d0a05f960e3ab39a8c26b7b230bb8a9< ad9011a795407093dcf507f6e5da1828987b4b47 affected
… +12 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-31602

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ALSA: ctxfi: Limit PTP to a single page
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Limit PTP to a single page Commit 391e69143d0a increased CT_PTP_NUM from 1 to 4 to support 256 playback streams, but the additional pages are not used by the card correctly. The CT20K2 hardware already has multiple VMEM_PTPAL registers, but using them separately would require refactoring the entire virtual memory allocation logic. ct_vm_map() always uses PTEs in vm->ptp[0].area regardless of CT_PTP_NUM. On AMD64 systems, a single PTP covers 512 PTEs (2M). When aggregate memory allocations exceed this limit, ct_vm_map() tries to access beyond the allocated space and causes a page fault: BUG: unable to handle page fault for address: ffffd4ae8a10a000 Oops: Oops: 0002 [#1] SMP PTI RIP: 0010:ct_vm_map+0x17c/0x280 [snd_ctxfi] Call Trace: atc_pcm_playback_prepare+0x225/0x3b0 ct_pcm_playback_prepare+0x38/0x60 snd_pcm_do_prepare+0x2f/0x50 snd_pcm_action_single+0x36/0x90 snd_pcm_action_nonatomic+0xbf/0xd0 snd_pcm_ioctl+0x28/0x40 __x64_sys_ioctl+0x97/0xe0 do_syscall_64+0x81/0x610 entry_SYSCALL_64_after_hwframe+0x76/0x7e Revert CT_PTP_NUM to 1. The 256 SRC_RESOURCE_NUM and playback_count remain unchanged.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于ALSA ctxfi驱动CT_PTP_NUM增加后未正确使用额外页面，ct_vm_map()访问超出分配空间导致页错误。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 391e69143d0a05f960e3ab39a8c26b7b230bb8a9 ~ c5908160e17cb56e1f61fbaee08adc21083f4933 -
Linux Linux 3.2 -

II. Public POCs for CVE-2026-31602

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-31602

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-31602 (5)

Same Patch Batch · Linux · 2026-04-24 · 138 CVEs total

CVE-2026-31607 9.8 CRITICAL usbip: validate number_of_packets in usbip_pack_ret_submit()
CVE-2026-31659 9.8 CRITICAL batman-adv: reject oversized global TT response buffers
CVE-2026-31536 9.8 CRITICAL smb: server: let send_done handle a completion without IB_SEND_SIGNALED
CVE-2026-31657 9.8 CRITICAL batman-adv: hold claim backbone gateways by reference
CVE-2026-31609 9.8 CRITICAL smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush()
CVE-2026-31649 9.8 CRITICAL net: stmmac: fix integer underflow in chain mode
CVE-2026-31637 9.8 CRITICAL rxrpc: reject undecryptable rxkad response tickets
CVE-2026-31608 9.8 CRITICAL smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list
CVE-2026-31668 9.8 CRITICAL seg6: separate dst_cache for input and output paths in seg6 lwtunnel
CVE-2026-31633 9.8 CRITICAL rxrpc: Fix integer overflow in rxgk_verify_response()
CVE-2026-31589 9.8 CRITICAL mm: call ->free_folio() directly in folio_unmap_invalidate()
CVE-2026-31669 9.8 CRITICAL mptcp: fix slab-use-after-free in __inet_lookup_established
CVE-2026-31636 9.1 CRITICAL rxrpc: fix RESPONSE authenticator parser OOB read
CVE-2026-31588 8.8 HIGH KVM: x86: Use scratch field in MMIO fragment to hold small write values
CVE-2026-31553 8.8 HIGH KVM: arm64: Fix the descriptor address in __kvm_at_swap_desc()
CVE-2026-31629 8.8 HIGH nfc: llcp: add missing return after LLCP_CLOSED checks
CVE-2026-31570 8.8 HIGH can: gw: fix OOB heap access in cgw_csum_crc8_rel()
CVE-2026-31622 8.8 HIGH NFC: digital: Bounds check NFC-A cascade depth in SDD response handler
CVE-2026-31558 8.8 HIGH LoongArch: KVM: Make kvm_get_vcpu_by_cpuid() more robust
CVE-2026-31611 8.6 HIGH ksmbd: require 3 sub-authorities before reading sub_auth[2]

Showing top 20 of 138 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-31602

No comments yet

Leave a comment