The ALSA ctxfi driver incorrectly permits the use of up to four Page Table Pages (PTPs) while the hardware only supports a single PTP. ct_vm_map() always walks through the first PTP, which means that if more than 512 PTEs (2 MiB on AMD64) are needed, the function accesses memory beyond the allocated page. This out‑of‑bounds read causes a kernel page fault and triggers a BUG, resulting in a kernel panic. The flaw leads to a denial of service and is classified as a memory corruption weakness (CWE‑788).

Linux kernels that include the 391e69143d0a commit, which increased CT_PTP_NUM from 1 to 4, are affected. This includes any recent kernel releases that shipped the change without the subsequent revert. Systems that use the CT20K2 audio controller—or similar hardware that relies on the ctxfi driver—may trigger the fault when an audio operation requires more than the allocated page. The vulnerability therefore targets host kernel memory on AMD64 platforms.

The CVSS score of 7.8 indicates high severity, but the EPSS score of <1 % shows that current exploitation is unlikely. The flaw is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is a local privileged user who can issue audio requests that consume memory beyond the single‑page limit, causing the kernel to panic. For administrators, the risk is moderate: high impact if executed, but low likelihood of exploitation at present.