Executive brief
A vulnerability in the Linux kernel's ALSA sound system driver for Creative X-Fi cards could allow a local user to crash the system. The issue occurs when the system attempts to manage audio playback streams, leading to a memory access error. This can result in a complete system outage (denial of service) or potentially allow for unauthorized access to system memory.
Technical details
The vulnerability exists in the ALSA ctxfi driver (sound/pci/ctxfi) due to an incorrect configuration of the Page Table Pages (PTP) count. While the driver was updated to support 256 playback streams by increasing CT_PTP_NUM, the ct_vm_map() function was not updated to correctly utilize multiple PTPs, continuing to use only the first area. On AMD64 systems, this limits the driver to 512 Page Table Entries (2M). When aggregate memory allocations exceed this limit, the driver attempts to access memory beyond the allocated space, triggering a kernel page fault (Oops). This is a local vulnerability that can be triggered via ioctl calls to the sound device. The fix involves reverting CT_PTP_NUM to 1 to ensure memory mapping remains within bounds.
Affected products
- Linux Linux Kernel 3.2 to 6.6.136, 6.7 to 6.12.83, 6.13 to 6.18.24, 6.19 to 6.19.14, 7.0 to 7.0.1
Timeline
- 2026-04-24: disclosed
- 2026-04-24: advisory
- 2026-06-01: patched
References
- https://git.kernel.org/stable/c/2b4331c08c0b385598b4d8ccd71e93ab3f4b2578
- https://git.kernel.org/stable/c/365c36e1a126c6aa1aecedd3a351bcabc66f0c29
- https://git.kernel.org/stable/c/3fd0685d7fef68c2d8a04876bcf9eaa0724ad6a5
- https://git.kernel.org/stable/c/452894005b4abe141b11fe01e7bfe152e6d3860f
- https://git.kernel.org/stable/c/ad9011a795407093dcf507f6e5da1828987b4b47
- https://git.kernel.org/stable/c/b7f5ecd13cce8c2f8fa5a84c9aab65997142577e
- https://git.kernel.org/stable/c/c5908160e17cb56e1f61fbaee08adc21083f4933