{"id":"CVE-2026-99068","kind":"vulnerability","aliases":["CVE-2026-99068"],"related":[],"title":"Linux kernel ALSA ctxfi driver leaks memory when clearing DAO input mappers","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: ctxfi: Fix memory leakage when clearing DAO input mappers\n\nCommit e576e7843c0d (\"ALSA: ctxfi: Simplify dao_clear_{left,right}_input() functions\")\ncentralized the DAO input mapper clearing logic in\ndao_clear_input(), but omitted the kfree() calls.\n\nIt removes the mapper entries from the list and sets their pointers\nto NULL without freeing the allocated array. This leaks memory each\ntime dao_clear_input() is called.\n\nStore the base pointer of the allocation before clearing the mapper\nentries and free the array after removing entries from the list.","summary":"The Linux kernel's ALSA ctxfi sound driver fails to free the array of DAO input mapper entries when clearing them, so memory leaks each time the function runs. The sources describe a memory leak only, with no sign of code execution or data exposure.","severity":"unknown","cvss":null,"epss":0.00206,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["alsa","creative-x-fi","linux-kernel","runtime","sound-driver"],"not_affected_if":["ctxfi-driver-not-loaded"],"how_to_check":"- Check the running kernel version with `uname -r` and compare against the fixed stable release in the NVD entry.\n- Check whether the ctxfi driver is loaded with `lsmod | grep snd_ctxfi` (unknown if the sources give a different module name).","fix":"- Update the Linux kernel to a release that includes the upstream fix for ALSA: ctxfi (version unknown from the sources).\n- Apply the distribution kernel update that carries the commit which stores the allocation base pointer and frees the array after removing entries.","status":"open","published_at":"2026-10-23T13:17:30+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T04:53:48+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T04:53:48Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream fix for ALSA: ctxfi (version unknown from the sources).\n- Apply the distribution kernel update that carries the commit which stores the allocation base pointer and frees the array after removing entries.","reach":"local","title":"Linux kernel ALSA ctxfi driver leaks memory when clearing DAO input mappers","impact":"low","summary":"The Linux kernel's ALSA ctxfi sound driver fails to free the array of DAO input mapper entries when clearing them, so memory leaks each time the function runs. The sources describe a memory leak only, with no sign of code execution or data exposure.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","alsa","sound-driver","creative-x-fi"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Kernel memory leaks on each call, slowly exhausting available memory","analyst_note":"","how_to_check":"- Check the running kernel version with `uname -r` and compare against the fixed stable release in the NVD entry.\n- Check whether the ctxfi driver is loaded with `lsmod | grep snd_ctxfi` (unknown if the sources give a different module name).","needs_analyst":false,"not_affected_if":["ctxfi-driver-not-loaded"],"who_is_affected":"Systems running a Linux kernel with the Creative X-Fi (ctxfi) ALSA sound driver loaded are affected, which in practice means desktops or workstations with that sound hardware. The sources do not say how often the leak triggers in normal use. Servers and systems without ctxfi hardware can likely skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000653,"input_tokens":3449,"output_tokens":616,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-99068':15A,18A 'alloc':140C,158C 'alsa':3A,19B,35B,86C,98C 'array':43B,141C,167C 'base':154C 'call':122C,151C 'central':107C 'clear':9A,50B,92C,102C,112C,116C,148C,160C 'code':71B 'commit':96C 'creativ':21B 'creative-x-fi':20B 'ctxfi':4A,36B,87C,99C 'cve':13A,16A 'dao':10A,45B,93C,101C,109C,115C,147C 'data':74B 'describ':62B 'driver':5A,30B,38B 'e576e7843c0d':97C 'entri':48B,127C,163C,170C 'execut':72B 'exposur':75B 'fail':39B 'fi':23B 'fix':88C 'follow':81C 'free':41B,138C,165C 'function':58B,106C 'input':11A,46B,94C,105C,110C,117C,149C 'kernel':2A,26B,33B,79C 'kfree':121C 'leak':6A,54B,65B,143C 'leakag':90C 'left':103C 'linux':1A,25B,32B,78C 'linux-kernel':24B 'list':130C,173C 'logic':113C 'mapper':12A,47B,95C,111C,126C,162C 'memori':7A,53B,64B,89C,144C 'null':136C 'omit':119C 'pointer':134C,155C 'remov':124C,169C 'resolv':85C 'right':104C 'run':59B 'runtim':27B 'set':132C 'sign':69B 'simplifi':100C 'sound':29B,37B 'sound-driv':28B 'sourc':61B 'store':152C 'time':56B,146C 'vulner':82C 'without':137C 'x':22B","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the Creative X-Fi (ctxfi) ALSA sound driver loaded are affected, which in practice means desktops or workstations with that sound hardware. The sources do not say how often the leak triggers in normal use. Servers and systems without ctxfi hardware can likely skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:30+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99068","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99068","severity":null,"published_at":"2026-10-23T13:17:30+00:00","modified_at":"2026-10-23T13:17:30+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-99068","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-99068","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}