Security readout for executives and security teams
Plain-English summary
A low-privileged local user may be able to crash an affected Linux system through audio operations using the ALSA ctxfi driver. The driver can access memory beyond its allocated page-table space. The published score asserts confidentiality, integrity, and availability impact, although the supplied technical evidence specifically demonstrates a kernel page fault.
Executive priority
Treat this as a prompt patching priority for workstations or specialist systems using ctxfi audio hardware. Priority can be reduced after confirming the driver path is absent. It is not presented as an internet-wide emergency because exploitation requires local access and no active exploitation is documented.
Technical view
A prior change increased CT_PTP_NUM from one to four, but ct_vm_map() continued using only vm->ptp[0]. On AMD64, that page covers 512 entries, or 2 MiB. Larger aggregate allocations cause an out-of-bounds access and kernel page fault. The stable fix restores CT_PTP_NUM to one.
Likely exposure
Exposure is concentrated on systems running an affected Linux kernel with the ctxfi audio driver and compatible hardware present or usable. Systems without that driver path are unlikely to be exposed. The supplied version data does not provide clear branch boundaries, so verify distribution backports using the cited fix commits.
Exploitation context
The CVSS vector describes a local, low-complexity attack requiring low privileges and no user interaction. This CVE is not listed as KEV, and the supplied sources report neither active exploitation nor a public proof of concept. The documented result is a kernel page fault during PCM playback preparation.
Researcher notes
The supplied affected-version data is internally difficult to interpret, including repeated commit identifiers and mixed release values. Validate each distribution kernel through backport records rather than version strings alone. The trace demonstrates an out-of-bounds kernel access and page fault; broader confidentiality and integrity consequences are asserted by CVSS but not demonstrated in the description.
Mitigation direction
- Update affected systems to vendor-supported kernels containing the applicable cited stable fix.
- Prioritize updates where the ctxfi driver and associated audio hardware are present or usable.
- If updating is delayed, consult distribution guidance; the supplied sources name no separate workaround.
Validation and detection
- Inventory running kernel versions and determine whether snd_ctxfi is loaded or bound to hardware.
- Check kernel changelogs or source for the applicable cited stable fix commit.
- After updating, verify the fixed kernel is running, not merely installed.
- Monitor kernel logs for ct_vm_map page faults during normal audio operations.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-31602 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/c5908160e17cb56e1f61fbaee08adc21083f4933CVE reference, Linux
- https://git.kernel.org/stable/c/de8016fb0904d68ac886e375069535996baa42eeCVE reference, Linux
- https://git.kernel.org/stable/c/2b4331c08c0b385598b4d8ccd71e93ab3f4b2578CVE reference, Linux
- https://git.kernel.org/stable/c/452894005b4abe141b11fe01e7bfe152e6d3860fCVE reference, Linux
- https://git.kernel.org/stable/c/365c36e1a126c6aa1aecedd3a351bcabc66f0c29CVE reference, Linux
- https://git.kernel.org/stable/c/3fd0685d7fef68c2d8a04876bcf9eaa0724ad6a5CVE reference, Linux
- https://git.kernel.org/stable/c/b7f5ecd13cce8c2f8fa5a84c9aab65997142577eCVE reference, Linux
- https://git.kernel.org/stable/c/ad9011a795407093dcf507f6e5da1828987b4b47CVE reference, Linux
- https://git.kernel.org/stable/c/e9418da50d9e5c496c22fe392e4ad74c038a94ebCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.