In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Limit PTP to a single page Commit 391e69143d0a increased CTPTPNUM from 1 to 4 to support 256 playback streams, but the additional pages are not used by the card correctly. The CT20K2 hardware already has multiple VMEMPTPAL registers, but using them separately would require refactoring the entire virtual memory allocation logic. ctvmmap() always uses PTEs in vm->ptp[0].area regardless of CTPTPNUM. On AMD64 systems, a single PTP covers 512 PTEs (2M). When aggregate memory allocations exceed this limit, ctvmmap() tries to access beyond the allocated space and causes a page fault: BUG: unable to handle page fault for address: ffffd4ae8a10a000 Oops: Oops: 0002 [#1] SMP PTI RIP: 0010:ctvmmap+0x17c/0x280 [sndctxfi] Call Trace: atcpcmplaybackprepare+0x225/0x3b0 ctpcmplaybackprepare+0x38/0x60 sndpcmdoprepare+0x2f/0x50 sndpcmactionsingle+0x36/0x90 sndpcmactionnonatomic+0xbf/0xd0 sndpcm_ioctl+0x28/0x40 _x64sysioctl+0x97/0xe0 dosyscall64+0x81/0x610 entrySYSCALL64afterhwframe+0x76/0x7e Revert CTPTPNUM to 1. The 256 SRCRESOURCENUM and playbackcount remain unchanged.