CVE-2026-23076 — high severity vulnerability | Dragons Community

Signals

NVD · CVE-2026-64604 · In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode When updating CR8NVD · CVE-2026-64603 · In the Linux kernel, the following vulnerability has been resolved: platform/x86: intel-hid: Protect ACPI notify handler against recursion Since commit e2ffcda1NVD · CVE-2026-64602 · In the Linux kernel, the following vulnerability has been resolved: iio: adc: spear: Initialize completion before requesting IRQ In the report from Jaeyoung ChuNVD · CVE-2026-64601 · In the Linux kernel, the following vulnerability has been resolved: ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on eachCISA KEV · CVE-2026-33824 · 9.8 · Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability · Added 2026-08-18 · Due 2026-08-21CISA KEV · CVE-2026-59310 · 9.8 · Broadcom VMware vCenter Path Traversal Vulnerability · Added 2026-08-18 · Due 2026-08-21NVD · CVE-2026-64604 · In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode When updating CR8NVD · CVE-2026-64603 · In the Linux kernel, the following vulnerability has been resolved: platform/x86: intel-hid: Protect ACPI notify handler against recursion Since commit e2ffcda1NVD · CVE-2026-64602 · In the Linux kernel, the following vulnerability has been resolved: iio: adc: spear: Initialize completion before requesting IRQ In the report from Jaeyoung ChuNVD · CVE-2026-64601 · In the Linux kernel, the following vulnerability has been resolved: ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on eachCISA KEV · CVE-2026-33824 · 9.8 · Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability · Added 2026-08-18 · Due 2026-08-21CISA KEV · CVE-2026-59310 · 9.8 · Broadcom VMware vCenter Path Traversal Vulnerability · Added 2026-08-18 · Due 2026-08-21

DRAGONS COMMUNITY

CVE-2026-23076

· HIGHAnalyzed

CVSS v3.1

7.1

EPSS

0.13%

Published

Feb 4, 2026

Modified

Mar 18, 2026

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Fix potential OOB access in audio mixer handling In the audio mixer handling code of ctxfi driver, the conf field is used as a kind of loop index, and it's referred in the index callbacks (amixer_index() and sum_index()). As spotted recently by fuzzers, the current code causes OOB access at those functions. | UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.8/sound/pci/ctxfi/ctamixer.c:347:48 | index 8 is out of range for type 'unsigned char [8]' After the analysis, the cause was found to be the lack of the proper (re-)initialization of conj field. This patch addresses those OOB accesses by adding the proper initializations of the loop indices.

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Weaknesses (CWE)

CWE-125

Affected Products (12)

linux · linux_kernel (up to 5.10.249)vulnerable

linux · linux_kernel (up to 5.15.199)vulnerable

linux · linux_kernel (up to 6.1.162)vulnerable

linux · linux_kernel (up to 6.6.122)vulnerable

linux · linux_kernel (up to 6.12.68)vulnerable

linux · linux_kernel (up to 6.18.8)vulnerable

linux · linux_kernelvulnerable

linux · linux_kernelvulnerable

linux · linux_kernelvulnerable

linux · linux_kernelvulnerable

linux · linux_kernelvulnerable

linux · linux_kernelvulnerable

References (7)

https://git.kernel.org/stable/c/61006c540cbdedea83b05577dc7fb7fa18fe1276

Patch

https://git.kernel.org/stable/c/6524205326e0c1a21263b5c14e48e14ef7e449ae

Patch

https://git.kernel.org/stable/c/873e2360d247eeee642878fcc3398babff7e387c

Patch

https://git.kernel.org/stable/c/8c1d09806e1441bc6a54b9a4f2818918046d5174

Patch

https://git.kernel.org/stable/c/a8c42d11b0526a89192bd2f79facb4c60c8a1f38

Patch

https://git.kernel.org/stable/c/afca7ff5d5d4d63a1acb95461f55ca9a729feedf

Patch

https://git.kernel.org/stable/c/d77ba72558cd66704f0fb7e0969f697e87c0f71c

Patch

KEV Catalog EPSS Scores Vendors All CVEs