CVE-2026-31775

Vulnerability

A regression in the Linux kernel's ALSA ctxfi driver causes a kernel crash when the driver enumerates the SPDIF1 DAIO type during initialization on hw20k2 hardware. The root cause is a refactoring change that made the atc_get_resources() function loop over all DAIOTYP entries, including the SPDIF1 type, which is only valid for hw20k1 CTSB073X models and lacks a corresponding definition for hw20k2 [1].

Exploitation

Exploitation

An attacker would need to have local access to a system with a Sound Blaster X-Fi (ctxfi) sound card based on the hw20k2 chipset. The crash occurs automatically during driver initialization when the kernel module is loaded or when the system boots, without requiring any special user interaction beyond having the affected hardware present.

Impact

Successful exploitation results in a denial of service (DoS) through a kernel crash (NULL pointer dereference or similar) during driver initialization, rendering the sound card unusable and potentially crashing the system. The CVSS v3 score is 5.5 (Medium) with low attack complexity and low privileges required, but no confidentiality or integrity impact [1].

Mitigation

The fix is included in Linux kernel stable commit 75dc1980cf48826287e43dc7a49e310c6691f97e, which skips the SPDIF1 type in the parser loop and arranges the code for clarity [1]. Users should update to a kernel version containing this commit. No workaround is available other than avoiding the affected hardware or blacklisting the driver.