CVE-2026-46049: Linux Kernel ALSA ctxfi DoS Vulnerability

CVE-2026-46049 Overview

CVE-2026-46049 is a Linux kernel vulnerability in the Advanced Linux Sound Architecture (ALSA) ctxfi driver. The flaw resides in spdif_passthru_playback_get_resources(), which uses atc->pll_rate as the Reference Sample Rate (RSR) for its Master Sample Rate (MSR) calculation loop. Because pll_rate is only updated in atc_pll_init() and not in hw_pll_init(), it remains zero after card initialization. When spdif_passthru_playback_setup() skips atc_pll_init() for 32000 Hz playback, (rsr * desc.msr) evaluates to zero, causing the loop to spin indefinitely. The fix adds a fallback to atc->rsr when atc->pll_rate is zero.

Critical Impact
A local user with audio device access can trigger an infinite kernel loop by initiating S/PDIF passthrough playback at 32000 Hz, resulting in a denial of service.

Affected Products

Linux kernel — ALSA ctxfi driver (Creative Sound Blaster X-Fi family)
Stable kernel branches referenced in upstream commits 09496158, 25ded535, 30f9494c, 7d616621, and 95b1ee84
Distributions shipping affected stable kernels prior to backport application

Discovery Timeline

2026-05-27 - CVE-2026-46049 published to the National Vulnerability Database (NVD)
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-46049

Vulnerability Analysis

The vulnerability is an infinite loop condition (a denial of service flaw) in the ALSA ctxfi sound driver for Creative X-Fi audio hardware. The function spdif_passthru_playback_get_resources() iterates while calculating the Multiplier Sample Rate (MSR) value using atc->pll_rate as the Reference Sample Rate (RSR) input. The loop terminates based on the product (rsr * desc.msr), which must reach a non-zero target value.

When pll_rate is zero, this product is always zero. The termination condition is never satisfied, and the kernel thread executing the loop never yields its CPU cycle for legitimate work. This produces 100% CPU utilization on the affected core and stalls the audio subsystem until the system is forcibly rebooted.

Root Cause

The root cause is an uninitialized state assumption in the driver. atc->pll_rate is populated only inside atc_pll_init(). The function hw_pll_init() configures the hardware PLL during hw_card_init() to a default RSR but does not propagate that value to the atc->pll_rate software state variable. When spdif_passthru_playback_setup() bypasses atc_pll_init() (specifically for the 32000 Hz sample rate path), the driver reads a stale zero value and uses it as a divisor-style input to the MSR loop.

Attack Vector

Exploitation requires local access and the ability to open an ALSA PCM device configured for S/PDIF passthrough playback at 32000 Hz. Any unprivileged user that is a member of the audio group, or any process with access to /dev/snd/pcm* device nodes, can trigger the condition. The vulnerability has no network-facing attack surface and does not yield code execution or privilege escalation, but it does produce a reliable kernel-side resource exhaustion.

No verified public exploit code is available. The condition can be triggered by configuring ALSA to perform S/PDIF passthrough at 32 kHz on hardware using the ctxfi driver. See the upstream commits referenced in Linux Kernel Change 09496158 and Linux Kernel Change 25ded535 for the patched code path.

Detection Methods for CVE-2026-46049

Indicators of Compromise

A kernel thread or user process bound to ALSA PCM playback consuming 100% CPU on a single core with no forward progress.
Soft lockup warnings in dmesg referencing the ctxfi module or spdif_passthru_playback symbols.
Audio subsystem becoming unresponsive after a 32000 Hz S/PDIF passthrough stream is opened.

Detection Strategies

Query loaded kernel modules with lsmod | grep ctxfi to identify hosts running the affected driver.
Compare running kernel version (uname -r) and ALSA package versions against the fixed stable releases listed in the kernel.org commits.
Monitor /proc/softirqs and per-CPU utilization for sustained single-core saturation correlated with audio process activity.

Monitoring Recommendations

Forward dmesg and journalctl -k output to a centralized logging platform and alert on watchdog: BUG: soft lockup events tagged with snd_ctxfi.
Track per-process CPU time for pulseaudio, pipewire, and direct ALSA clients to detect anomalous sustained kernel-mode CPU usage.
Audit which users and services hold open file descriptors to /dev/snd/pcm* nodes on systems with Creative X-Fi hardware.

How to Mitigate CVE-2026-46049

Immediate Actions Required

Apply the upstream patches referenced in the kernel.org stable commits to all systems running the ctxfi driver.
Update to a Linux kernel release from your distribution vendor that includes the fallback-to-atc->rsr fix.
On systems where the patch cannot be applied immediately, unload the ctxfi module with modprobe -r snd_ctxfi if Creative X-Fi audio is not required.

Patch Information

The fix adds a fallback so that atc->rsr is used when atc->pll_rate is zero, reflecting the actual hardware state configured by hw_card_init(). Patched commits are available at Linux Kernel Change 09496158, Linux Kernel Change 25ded535, Linux Kernel Change 30f9494c, Linux Kernel Change 7d616621, and Linux Kernel Change 95b1ee84.

Workarounds

Blacklist the snd_ctxfi module on hosts that do not require Creative X-Fi audio support.
Restrict membership in the audio group and limit access to /dev/snd/pcm* device nodes to trusted users.
Configure the audio stack to avoid 32000 Hz S/PDIF passthrough sample rates until the patched kernel is deployed.

bash

# Blacklist the affected ctxfi driver until a patched kernel is installed
echo 'blacklist snd_ctxfi' | sudo tee /etc/modprobe.d/blacklist-ctxfi.conf
sudo modprobe -r snd_ctxfi
sudo update-initramfs -u