Home/CVE/In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Limit PTP to a single page Commit 391
CVE

CVE-2026-31602

In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Limit PTP to a single page Commit 391

In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Limit PTP to a single page Commit 391e69143d0a increased CT_PTP_NUM from 1 to 4 to support 256 playback streams, but the additional pages are not used by the card correctly. The CT20K2 hardware already has multiple VMEM_PTPAL registers, but using them separately would require refactoring the entire virtual memory allocation logic. ct_vm_map() always uses PTEs in vm-ptp[0].area regardless of CT_PTP_NUM. On AMD64 systems, a single PTP covers 512 PTEs (2M).

When aggregate memory allocations exceed this limit, ct_vm_map() tries to access beyond the allocated space and causes a page fault: BUG: unable to handle page fault for address: ffffd4ae8a10a000 Oops: 0002 [#1] SMP PTI RIP: 0010:ct_vm_map+0x17c/0x280 [snd_ctxfi] Call Trace: atc_pcm_playback_prepare+0x225/0x3b0 ct_pcm_playback_prepare+0x38/0x60 snd_pcm_do_prepare+0x2f/0x50 snd_pcm_action_single+0x36/0x90 snd_pcm_action_nonatomic+0xbf/0xd0 snd_pcm_ioctl+0x28/0x40 __x64_sys_ioctl+0x97/0xe0 do_syscall_64+0x81/0x610 entry_SYSCALL_64_after_hwframe+0x76/0x7e Revert CT_PTP_NUM to 1. The 256 SRC_RESOURCE_NUM and playback_count remain unchanged.

HIGH · CVSS 7.8 EPSS 0.00015
Schedule remediation
  • CVSS base score ≥ 7.0
Sigma rules0 YARA rules0
Look this up elsewhere - one-click external pivots
NVDCVE.orgCISAVulnersExploit-DBGitHub PoCVulnCheck KEVGreyNoise
▸ How to read a CVE - triage first, then detect and patch
This page is every public fact about CVE-2026-31602, cross-linked. Its job is to answer one question fast - does this need my attention now? - and then hand you the two things you do about it. Here is how an analyst reads it.
Triage: should I act now? Four signals, and they are not interchangeable:
CVSSseverity - how bad it is IF exploited, 0-10. A high CVSS alone is not urgency; a flaw can be a perfect 10 and never actually be attacked. EPSSprobability - a model’s estimate of the chance it is exploited in the next 30 days, 0-1. This is the “will it actually happen” signal. CISA KEVconfirmed - it is being exploited in the wild right now. The strongest signal on the page; KEV beats any score. Weaponisedavailability - public exploits / PoCs, and especially Metasploit modules rated Excellent / Great. Reliable, packaged exploit code means low-skill attackers can use it today.
How they combine: KEV, or a dependable Metasploit module, means patch now regardless of CVSS. High CVSS + low EPSS + no exploit is real but not an emergency - schedule it. Low CVSS but KEV-listed still gets patched now. The verdict above already weighed these for you; this is how it got there.
Then what - two workflows:
Detectwhen you cannot patch today, follow this CVE to the ATT&CK techniques it enables, then Build a SIEM detection (the green button) - author a rule, test it in Atomic, deploy it. That buys visibility while the patch waits. PatchAffected products / packages tell you if you are exposed; Fixed versions by distribution and Vendor advisories give the exact version that closes it.
Reading order for the panels below: verdict + badges, then Public exploits / Metasploit (is it weaponised), then ATT&CK techniques + Sigma / IDS rules (can I detect it), then Affected products / packages + Fixed versions (am I exposed, what patches it), then Threat actors / IOCs (who uses it), then Scoring & timeline / references (the evidence).
◆

ATT&CK techniques

1

Techniques this CVE enables - linked via CWECAPECATT&CK. High◆ = named directly in ATT&CK or Nuclei templates.

T1068 · Exploitation for Privilege Escalation
▤ Build a SIEM detection for these techniques
▤

Affected Products & Versions

5
linux kernel>= 3.2 and < 6.6.136
linux kernel>= 6.7 and < 6.12.83
linux kernel>= 6.13 and < 6.18.24
linux kernel>= 6.19 and < 6.19.14
linux kernel>= 7.0 and < 7.0.1
📦

Fixed versions by distribution

24
The package version that resolves this CVE on each Linux distribution, from the vendor’s published security data. fixed in shows a patched version exists; open means the package is listed as affected with no fix yet.
suse sle15cluster-md-kmp-default fixed in 0:6.4.0-150600.23.112.1
suse sle15cluster-md-kmp-rt fixed in 0:6.4.0-150700.7.54.1
suse sle15dlm-kmp-default fixed in 0:6.4.0-150600.23.112.1
suse sle15dlm-kmp-rt fixed in 0:6.4.0-150700.7.54.1
suse sle15gfs2-kmp-default fixed in 0:6.4.0-150600.23.112.1
suse sle15gfs2-kmp-rt fixed in 0:6.4.0-150700.7.54.1
suse sle15kernel-64kb fixed in 0:6.4.0-150700.53.55.1
suse sle15kernel-azure fixed in 0:6.4.0-150700.53.55.1
suse sle15kernel-default fixed in 0:6.4.0-150600.23.112.1
suse sle15kernel-default-base fixed in 0:6.4.0-150700.53.55.1.150700.17.33.1
suse sle15kernel-default-extra fixed in 0:6.4.0-150700.53.55.1
suse sle15kernel-docs fixed in 0:5.14.21-150400.24.219.1
suse sle15kernel-livepatch-6_4_0-150700_7_54-rt fixed in 0:1-150700.1.3.1
suse sle15kernel-macros fixed in 0:5.14.21-150400.24.219.1
suse sle15kernel-obs-build fixed in 0:5.14.21-150400.24.219.1
suse sle15kernel-rt fixed in 0:6.4.0-150700.7.54.1
suse sle15kernel-source fixed in 0:6.4.0-150600.23.112.1
suse sle15kernel-source-rt fixed in 0:6.4.0-150700.7.54.1
suse sle15kernel-syms fixed in 0:5.14.21-150400.24.219.1
suse sle15kernel-syms-rt fixed in 0:6.4.0-150700.7.54.1
suse sle15kernel-zfcpdump fixed in 0:5.14.21-150400.24.219.1
suse sle15ocfs2-kmp-default fixed in 0:6.4.0-150600.23.112.1
suse sle15ocfs2-kmp-rt fixed in 0:6.4.0-150700.7.54.1
suse sle15reiserfs-kmp-default fixed in 0:6.4.0-150600.23.112.1
▣

Scoring & Timeline

7.8
HIGH · CVSS v3.1 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67
View on NVD
Attack Vector
Network Adjacent Local Physical
Attack Complexity
Low High
Privileges Required
None Low High
User Interaction
None Required
Scope
Unchanged Changed
Confidentiality
None Low High
Integrity
None Low High
Availability
None Low High
Published to NVD24 Apr 2026 · 03:16 PM
CVSS VectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
⚑

Vendor Advisories

14
suse-csafSUSE-SU-2026:2238-1
suse-csafSUSE-SU-2026:2215-1
suse-csafSUSE-SU-2026:2216-1
suse-csafSUSE-SU-2026:2217-1
suse-csafSUSE-SU-2026:2195-1
🔗

References & Sources

9
Source URLs (vendor pages, mailing lists, write-ups). Exploit/PoC links are in their own section above to avoid duplication.
https://git.kernel.org/stable/c/365c36e1a126c6aa1aecedd3a351bcabc66f0c29Patch
https://git.kernel.org/stable/c/3fd0685d7fef68c2d8a04876bcf9eaa0724ad6a5Patch
https://git.kernel.org/stable/c/452894005b4abe141b11fe01e7bfe152e6d3860fPatch
https://git.kernel.org/stable/c/ad9011a795407093dcf507f6e5da1828987b4b47Patch
https://git.kernel.org/stable/c/b7f5ecd13cce8c2f8fa5a84c9aab65997142577ePatch
https://git.kernel.org/stable/c/e9418da50d9e5c496c22fe392e4ad74c038a94ebPatch
SOC and Response
CVE triage
Stack monitoring
Am I affected
IOC triage
KEV catalog
Daily brief
Change tracking
Detection Engineering
Coverage workspace
Detection coverage
Coverage check
Telemetry ceiling
SIEM query builder
Sigma rules
SIEM rules
YARA rules
Network rules
D3FEND
Threat Hunting
Threat actors
ATT&CK techniques
Attack paths
Indicators
Atomic tests
Red Team and Pentest
Exploitability triage
Recon pack
Attack paths
CAPEC patterns
Adversary emulation
Compliance and GRC
Framework mapping
Control assessment
Audit view
Coverage report
Atlas Search Threat actors Techniques Tools & malware CWE CAPEC KEV catalog Package vulns TAXII feed Data sources
About All capabilities Pricing API docs Live status Privacy policy Terms of service
threatengine.sh