CVE-2026-46049

What it actually does

CVE-2026-46049 is a local denial-of-service flaw in the Linux kernel ALSA ctxfi sound driver. The driver’s S/PDIF passthrough playback setup can use an uninitialized or zero PLL rate when configuring 32,000 Hz playback. Because the MSR calculation loop multiplies by this zero value, the loop can spin indefinitely, consuming kernel execution time and potentially causing a system hang, soft lockup, or loss of audio subsystem availability. The issue does not provide confidentiality or integrity impact and does not directly enable privilege escalation.

Why it matters to the business

An authenticated local user or local process with access to the affected Creative X-Fi/ctxfi ALSA audio device can trigger a kernel-level availability failure. On desktops, workstations, kiosks, media systems, or embedded Linux deployments using the affected driver, this can cause disruption, device freezes, or service downtime requiring intervention or reboot. The risk is lower for headless servers or systems without the affected hardware/driver loaded. The vulnerability is not listed in CISA KEV, has no known exploit maturity, and has a very low EPSS score, so remediation should be prioritized based on whether affected audio hardware and the ctxfi driver are present.

How an attack unfolds

An attacker first needs local code execution or an interactive local account on a Linux system where the ALSA ctxfi driver is available and the relevant S/PDIF passthrough path can be exercised. The attacker opens the ALSA PCM device associated with the ctxfi card and requests S/PDIF passthrough playback using a 32,000 Hz configuration that causes spdif_passthru_playback_setup() to skip PLL initialization. Because atc->pll_rate remains zero, spdif_passthru_playback_get_resources() enters an MSR calculation loop where the terminating condition is never reached. This can make the kernel spin indefinitely in the driver path, leading to a denial of service such as a hung audio subsystem, soft lockup, or system-wide unresponsiveness.

How to fix it

Update the Linux kernel to a version that includes the ALSA ctxfi fix adding a fallback from atc->pll_rate to the default atc->rsr value when pll_rate is zero. Because no exact fixed package versions were provided, use the security advisory or package changelog from the operating system vendor or kernel distribution and confirm that the patch for “ALSA: ctxfi: Add fallback to default RSR for S/PDIF” is included. Where immediate patching is not possible, reduce exposure by unloading or blacklisting the snd_ctxfi driver on systems that do not require Creative X-Fi audio, disabling access to local audio devices for untrusted users, restricting interactive shell access, and limiting container or sandbox access to /dev/snd devices.

How to confirm the fix worked

Confirm remediation by verifying that the running kernel package includes the upstream ALSA ctxfi patch and that the system has rebooted into the patched kernel. Check kernel build changelogs or distribution advisories for the commit/message “ALSA: ctxfi: Add fallback to default RSR for S/PDIF.” On systems with the hardware present, validate that S/PDIF passthrough playback at 32,000 Hz no longer causes a hang or soft lockup. Also verify whether the snd_ctxfi module is loaded with lsmod or modinfo; if mitigation is chosen instead of patching, confirm that the module cannot be loaded and that /dev/snd access is restricted as intended.

Typical attack path

1. Gain local access to a Linux system as an authenticated user or execute code through an existing local application context.
2. Confirm that the affected ALSA ctxfi driver and compatible Creative X-Fi audio hardware are present or that the driver is loaded.
3. Open the ALSA PCM playback device exposed by the ctxfi driver.
4. Request S/PDIF passthrough playback with a 32,000 Hz sample rate or otherwise trigger the vulnerable setup path.
5. Cause the driver to enter an indefinite MSR calculation loop because the PLL rate is zero.
6. Sustain a local denial of service until the system recovers, the driver path is interrupted, or the machine is rebooted.

How to detect it

Look for evidence of local denial-of-service attempts or crashes involving the ALSA ctxfi driver. Useful sources include kernel logs, system journal entries, audit logs for access to /dev/snd devices, endpoint telemetry showing audio test utilities or media tools invoked by unusual users, and crash dump or kdump artifacts from affected hosts. Search for soft lockup, hung task, watchdog, or kernel panic messages occurring near references to snd_ctxfi, ctxfi, S/PDIF, PCM playback, or 32,000 Hz audio configuration. Because this vulnerability does not inherently create files, network traffic, persistence, or privilege changes, detection is primarily behavioral and log-based rather than IOC-driven. Investigate local users or processes that accessed ALSA PCM devices immediately before a system hang or reboot.

• snd_ctxfi
• ctxfi
• spdif_passthru_playback_setup
• spdif_passthru_playback_get_resources
• ALSA: ctxfi
• S/PDIF
• soft lockup
• BUG: soft lockup
• watchdog: BUG: soft lockup
• INFO: task
• blocked for more than
• /dev/snd/pcm
• /dev/snd/pcmC
• /dev/snd/controlC
• /proc/asound
• Creative X-Fi

What your security team should do

• Inventory Linux endpoints and appliances for loaded snd_ctxfi modules or Creative X-Fi/ctxfi audio hardware before broad prioritization.
• Patch affected systems through the operating system or kernel vendor, prioritizing workstations, kiosks, media systems, and multi-user Linux machines where local users can access audio devices.
• If patching is delayed, blacklist snd_ctxfi or remove access to affected audio devices where the hardware is not business-critical.
• Restrict local interactive access and /dev/snd device access for untrusted users, containers, and sandboxed applications.
• Monitor kernel logs for soft lockups, hung tasks, or ALSA ctxfi errors that coincide with local audio activity.
• Treat this as an availability-focused local issue; it is not currently known to be exploited in the wild, is not in KEV, and has a very low EPSS score.