CVE-2026-31775: Linux Kernel ALSA ctxfi DoS Vulnerability

CVE-2026-31775 Overview

CVE-2026-31775 is a local denial of service vulnerability in the Linux kernel's Advanced Linux Sound Architecture (ALSA) ctxfi driver. The flaw exists in the Creative X-Fi sound card driver after a refactoring change in atc_get_resources() modified how the atc->daios[] array is populated. The function now iterates over all enum DAIOTYP entries, including the SPDIF1 type, which is only valid for the hw20k1 CTSB073X model and has no equivalent definition for hw20k2 hardware. Local users on systems with affected hardware can trigger a kernel crash, resulting in availability impact.

Critical Impact

A local low-privileged user on a system with hw20k2 Creative X-Fi audio hardware can trigger a kernel crash through the ALSA ctxfi driver initialization path, causing system-wide denial of service.

Affected Products

• Linux Kernel 7.0-rc1 through 7.0-rc6
• Linux Kernel mainline branches containing the ctxfi driver refactoring
• Systems using the ALSA ctxfi driver with Creative X-Fi hw20k2 hardware

Discovery Timeline

• 2026-05-01 - CVE-2026-31775 published to NVD
• 2026-05-07 - Last updated in NVD database

Technical Details for CVE-2026-31775

Vulnerability Analysis

The vulnerability resides in the Creative X-Fi sound card driver (sound/pci/ctxfi/) within the Linux kernel's ALSA subsystem. A recent refactor of the xfi driver changed how the Digital Audio Input/Output (DAIO) resource array atc->daios[] is assigned during initialization in atc_get_resources(). The previous implementation iterated over only a subset of enum DAIOTYP values, but the refactored code loops over every enumeration entry.

The last entry, SPDIF1, is a special-purpose type used exclusively by the hw20k1 CTSB073X model as a replacement for SPDIFIO. No corresponding definition exists for the hw20k2 hardware variant. When the parser encounters SPDIF1 on hw20k2 systems, the missing hardware information triggers a kernel crash. A prior workaround in commit b045ab3dff97 ("ALSA: ctxfi: Fix missing SPDIFI1 index handling") masked the symptom, but the upstream fix addresses the root cause by skipping the unsupported SPDIF1 type in the parser loop.

Root Cause

The root cause is improper input validation [CWE-noinfo] during DAIO enumeration. The refactored loop assumes every enum DAIOTYP value has a valid hardware mapping on every supported chipset. The hw20k2 code path lacks a definition for SPDIF1, so the dereference of missing hardware information leads to a kernel-level fault.

Attack Vector

Exploitation requires local access with low privileges. An attacker capable of triggering driver initialization, such as through module loading or device probing on hardware combinations that expose the issue, causes the kernel to crash. The vulnerability does not provide code execution or information disclosure—impact is limited to availability. The vulnerability manifests in the atc_get_resources() function during DAIO enumeration. See the upstream kernel commits for technical details.

Detection Methods for CVE-2026-31775

Indicators of Compromise

• Unexpected kernel oops or panic entries in dmesg or /var/log/kern.log referencing ctxfi, atc_get_resources, or SPDIF1
• System crashes coinciding with audio subsystem initialization or snd_ctxfi module load events
• Repeated module load failures for the snd-ctxfi driver on systems with Creative X-Fi hw20k2 hardware

Detection Strategies

• Monitor kernel ring buffer output for crash signatures involving the ctxfi driver and DAIO initialization paths
• Inventory hosts running affected kernel versions (7.0-rc1 through 7.0-rc6) using package management telemetry
• Correlate audio device probe events with system reboot or crash events to identify exploitation patterns

Monitoring Recommendations

• Centralize kernel logs and alert on BUG:, Oops:, or kernel panic strings paired with ctxfi references
• Track Linux kernel versions across the fleet and flag hosts running pre-patch release candidates
• Audit module load activity for snd-ctxfi originating from non-administrative users or unexpected processes

How to Mitigate CVE-2026-31775

Immediate Actions Required

• Apply the upstream kernel patches from commits 75dc1980cf48826287e43dc7a49e310c6691f97e and a79c4c42057818bd9de45d2627464b4f0e02196a once available in your distribution
• Restrict local access on systems with Creative X-Fi audio hardware until patching is complete
• Blacklist the snd-ctxfi module on affected hosts that do not require Creative X-Fi audio support

Patch Information

The Linux kernel maintainers resolved the issue by skipping the unsupported SPDIF1 type in the DAIO parser loop within atc_get_resources(). The fix is available in the upstream stable tree via the Kernel Git Commit 75dc1980 and Kernel Git Commit a79c4c42. Distribution-provided kernel updates incorporating these commits should be deployed through standard patch management processes.

Workarounds

• Blacklist the snd-ctxfi kernel module by adding blacklist snd-ctxfi to /etc/modprobe.d/blacklist.conf on systems that do not require Creative X-Fi audio
• Downgrade to a Linux kernel release prior to the ctxfi refactoring change if the patched kernel is not yet available
• Limit physical and shell access on systems with the affected hardware to reduce local attack surface

# Blacklist the affected ALSA ctxfi module
echo "blacklist snd-ctxfi" | sudo tee /etc/modprobe.d/disable-ctxfi.conf
sudo update-initramfs -u
sudo reboot