Executive brief
A vulnerability in the Linux kernel's audio driver for Creative Sound Blaster X-Fi cards can cause the system to hang or become unresponsive. When certain audio settings are used, the driver enters an infinite loop while trying to calculate hardware resources. This results in a denial-of-service condition where the system may stop responding to user input or other tasks.
Technical details
A vulnerability exists in the ALSA ctxfi driver (sound/pci/ctxfi/ctatc.c) within the spdif_passthru_playback_get_resources() function. The root cause is an uninitialized pll_rate variable that remains 0 after card initialization if atc_pll_init() is skipped (specifically at 32000 Hz). This causes a calculation loop for the Master Sample Rate (MSR) to multiply by zero, resulting in an infinite loop. An attacker with local access to audio devices could trigger this condition to cause a kernel hang (Denial of Service). The fix introduces a fallback to the default Reference Sample Rate (RSR) when the PLL rate is zero.
Affected products
- Linux Linux Kernel All versions prior to the fix in 6.x/stable branches
Timeline
- 2026-04-06: disclosed: Initial patch submission by Harin Lee
- 2026-05-27: advisory: CVE-2026-46049 published by NVD
References
- https://git.kernel.org/stable/c/09496158f6ebba8830593f8972035c02f97124c1
- https://git.kernel.org/stable/c/25ded535ee261161bcf19dafd525c542e606559d
- https://git.kernel.org/stable/c/30f9494c6f2b53a78822cfb653ffbb1d092d44c8
- https://git.kernel.org/stable/c/7d61662197ecdc458e33e475b6ada7f6da61d364
- https://git.kernel.org/stable/c/95b1ee8442cabbde83b2848e7c6100df90f3a00d