CVE-2026-31602: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31602 is an out-of-bounds memory access vulnerability in the Linux kernel's ALSA (Advanced Linux Sound Architecture) ctxfi driver, specifically in the ct_vm_map() function. The flaw was introduced when CT_PTP_NUM was increased from 1 to 4 to support 256 playback streams, but the additional page table pages are not correctly utilized by the CT20K2 hardware. On AMD64 systems, a single PTP covers only 512 PTEs (2MB); when aggregate memory allocations exceed this limit, ct_vm_map() accesses memory beyond the allocated space, triggering a kernel page fault. Affected Linux kernel versions include 3.2 through 6.6.135, 6.7 through 6.12.82, 6.13 through 6.18.23, 6.19.0 through 6.19.13, and 7.0.0. It carries a CVSS v3.1 base score of 7.8 (High), assigned by kernel.org (GitHub Advisory, Feedly).

The root cause is classified as CWE-788 (Access of Memory Location After End of Buffer). Commit 391e69143d0a increased CT_PTP_NUM from 1 to 4, but ct_vm_map() always references PTEs exclusively from vm->ptp[0].area regardless of this constant, meaning only a single page (512 PTEs / 2MB on AMD64) is ever used. When cumulative PCM playback memory allocations exceed this boundary, the function writes or reads beyond the allocated buffer, causing a kernel Oops page fault. Exploitation requires a local user with low privileges to trigger PCM playback ioctl operations (e.g., via snd_pcm_ioctl) that push aggregate allocations past the single-page limit. The fix reverts CT_PTP_NUM to 1 while leaving SRC_RESOURCE_NUM and playback_count at 256 (GitHub Advisory, Feedly).

A local attacker with low privileges can trigger a kernel page fault by initiating PCM audio playback operations that exhaust the single-page PTP limit, resulting in a kernel crash (Oops) and denial of service. The CVSS score also reflects potential high confidentiality and integrity impact, as out-of-bounds kernel memory access could theoretically expose or corrupt kernel memory contents. The vulnerability is scoped to the local system and does not directly enable lateral movement, but a kernel crash can disrupt all services on the affected host (Feedly, GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and low privileges, limiting the attack surface to users with the ability to interact with the audio subsystem (Feedly).

• Logs: Kernel log (dmesg / /var/log/kern.log) entries showing BUG: unable to handle page fault for address: ffffd4ae8a10a000 or similar kernel Oops messages with RIP: 0010:ct_vm_map+0x17c/0x280 [snd_ctxfi].
• Logs: Call trace entries referencing atc_pcm_playback_prepare, ct_pcm_playback_prepare, snd_pcm_do_prepare, snd_pcm_ioctl, and __x64_sys_ioctl in kernel crash logs.
• Process: Repeated or unusual PCM playback ioctl calls to the snd_ctxfi (CT20K2) audio device, particularly when many simultaneous playback streams are opened.
• System: Unexpected system reboots or kernel panics on hosts equipped with Creative Technology CT20K2 audio hardware.

Upgrade the Linux kernel to a patched version: 6.6.136 or later (for 3.2–6.6.x), 6.12.83 or later (for 6.7–6.12.x), 6.18.24 or later (for 6.13–6.18.x), 6.19.14 or later, or 7.0.1 or later. Patches are available via git.kernel.org and have been incorporated into SUSE and openSUSE security updates (e.g., SUSE-SU-2026:2068-1, SUSE-SU-2026:2111-1, SUSE-SU-2026:2195-1, SUSE-SU-2026:2215-1, SUSE-SU-2026:2238-1). As a temporary workaround for systems that cannot be patched immediately, restrict local user access to audio device ioctls via access control mechanisms, or disable the snd_ctxfi kernel module if CT20K2 audio hardware is not required (modprobe -r snd_ctxfi) (GitHub Advisory, Feedly, SUSE Advisory).

SUSE issued multiple security advisories addressing this CVE across their product lines, including SUSE-SU-2026:2068-1, SUSE-SU-2026:2111-1, SUSE-SU-2026:2195-1, SUSE-SU-2026:2215-1, and SUSE-SU-2026:2238-1. The Yocto Project security mailing list also flagged the vulnerability for embedded Linux users. No notable independent researcher commentary or significant social media discussion has been identified beyond standard vulnerability tracking (SUSE Advisory, Feedly).