PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46049 Linux CVE debrief

A logic error in the Linux kernel's ALSA ctxfi (Creative Sound Blaster X-Fi) driver can cause an infinite loop during S/PDIF passthrough playback setup. The vulnerability exists because `spdif_passthru_playback_get_resources()` uses `atc->pll_rate` for MSR calculation, but this field remains zero after card initialization when `hw_pll_init()` is used instead of `atc_pll_init()`. When 32000 Hz playback triggers a code path that skips `atc_pll_init()`, the calculation `(rsr * desc.msr)` evaluates to zero, causing the loop to spin indefinitely. The fix adds a fallback to `atc->rsr` when `atc->pll_rate` is zero, reflecting the hardware's actual PLL configuration. This is a local denial-of-service condition triggered by audio playback operations.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-16
Advisory published
2026-05-27
Advisory updated
2026-06-16

Who should care

Linux system administrators, kernel maintainers, and users of systems with Creative Sound Blaster X-Fi audio hardware

Technical summary

The ALSA ctxfi driver for Creative Sound Blaster X-Fi hardware contains a logic flaw in S/PDIF passthrough playback resource calculation. The function `spdif_passthru_playback_get_resources()` relies on `atc->pll_rate` for MSR (Master Sample Rate) calculations, but this field is only populated by `atc_pll_init()` and not by `hw_pll_init()`. After card initialization via `hw_card_init()`, `pll_rate` remains zero. When `spdif_passthrough_playback_setup()` skips `atc_pll_init()` for 32000 Hz sample rate, the subsequent calculation `(rsr * desc.msr)` produces zero, causing an unbounded loop. The resolution implements a fallback to `atc->rsr` (the default reference sample rate) when `pll_rate` is uninitialized, aligning software state with hardware configuration.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel patches from stable branches when available for your distribution
  • Monitor distribution security advisories for ALSA/sound driver updates
  • Restrict local access to audio devices where untrusted users may trigger S/PDIF passthrough at 32000 Hz
  • Review system logs for hung tasks or soft lockups in audio playback contexts as potential indicators

Evidence notes

Vulnerability description confirms infinite loop in kernel driver. Patch adds fallback to prevent zero-value MSR calculation. No CVSS score assigned by NVD at time of disclosure.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46049 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46049

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46049 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46049

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/09496158f6ebba8830593f8972035c02f97124c1

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/25ded535ee261161bcf19dafd525c542e606559d

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/30f9494c6f2b53a78822cfb653ffbb1d092d44c8

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/7d61662197ecdc458e33e475b6ada7f6da61d364

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/95b1ee8442cabbde83b2848e7c6100df90f3a00d

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.