---
id: "CVE-2026-99068"
kind: "vulnerability"
aliases: ["CVE-2026-99068"]
title: "Linux kernel ALSA ctxfi driver leaks memory when clearing DAO input mappers"
severity: "unknown"
cvss: null
epss: 0.00206
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["alsa", "creative-x-fi", "linux-kernel", "runtime", "sound-driver"]
not_affected_if: ["ctxfi-driver-not-loaded"]
published_at: "2026-10-23T13:17:30+00:00"
first_seen_at: "2026-10-23T21:57:34+00:00"
updated_at: "2026-10-25T12:38:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99068", "first_seen_at": "2026-10-23T21:57:34+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-99068", "first_seen_at": "2026-10-25T12:38:50+00:00"}]
---

# Linux kernel ALSA ctxfi driver leaks memory when clearing DAO input mappers

The Linux kernel's ALSA ctxfi sound driver fails to free the array of DAO input mapper entries when clearing them, so memory leaks each time the function runs. The sources describe a memory leak only, with no sign of code execution or data exposure.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the running kernel version with `uname -r` and compare against the fixed stable release in the NVD entry.
- Check whether the ctxfi driver is loaded with `lsmod | grep snd_ctxfi` (unknown if the sources give a different module name).

## Fix

- Update the Linux kernel to a release that includes the upstream fix for ALSA: ctxfi (version unknown from the sources).
- Apply the distribution kernel update that carries the commit which stores the allocation base pointer and frees the array after removing entries.

## Timeline

- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99068
- 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-99068

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers

Commit e576e7843c0d ("ALSA: ctxfi: Simplify dao_clear_{left,right}_input() functions")
centralized the DAO input mapper clearing logic in
dao_clear_input(), but omitted the kfree() calls.

It removes the mapper entries from the list and sets their pointers
to NULL without freeing the allocated array. This leaks memory each
time dao_clear_input() is called.

Store the base pointer of the allocation before clearing the mapper
entries and free the array after removing entries from the list.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_