CVE-2026-31602

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: ctxfi: Limit PTP to a single page

Commit 391e69143d0a increased CT_PTP_NUM from 1 to 4 to support 256

playback streams, but the additional pages are not used by the card

correctly. The CT20K2 hardware already has multiple VMEM_PTPAL

registers, but using them separately would require refactoring the

entire virtual memory allocation logic.

ct_vm_map() always uses PTEs in vm->ptp[0].area regardless of

CT_PTP_NUM. On AMD64 systems, a single PTP covers 512 PTEs (2M). When

aggregate memory allocations exceed this limit, ct_vm_map() tries to

access beyond the allocated space and causes a page fault:

BUG: unable to handle page fault for address: ffffd4ae8a10a000

Oops: Oops: 0002 [#1] SMP PTI

RIP: 0010:ct_vm_map+0x17c/0x280 [snd_ctxfi]

Call Trace:

atc_pcm_playback_prepare+0x225/0x3b0

ct_pcm_playback_prepare+0x38/0x60

snd_pcm_do_prepare+0x2f/0x50

snd_pcm_action_single+0x36/0x90

snd_pcm_action_nonatomi

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References