CVE-2026-31775

CVE-2026-31775

Medium · published May 1, 2026

CVSS v3.1
5.5
EPSS
0%
Percentile
3.3
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

ALSA: ctxfi: Don't enumerate SPDIF1 at DAIO initialization

The recent refactoring of xfi driver changed the assignment of

atc->daios[] at atc_get_resources(); now it loops over all enum

DAIOTYP entries while it looped formerly only a part of them.

The problem is that the last entry, SPDIF1, is a special type that

is used only for hw20k1 CTSB073X model (as a replacement of SPDIFIO),

and there is no corresponding definition for hw20k2. Due to the lack

of the info, it caused a kernel crash on hw20k2, which was already

worked around by the commit b045ab3dff97 ("ALSA: ctxfi: Fix missing

SPDIFI1 index handling").

This patch addresses the root cause of the regression above properly,

simply by skipping the incorrect SPDIF1 type in the parser loop.

For making the change clearer, the code is slightly arranged, too.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00143 · 3.3th percentile
Published
2026-05-01T19:16Z
Affected products (7)
ProductVersionsFixed in
linux/linux_kernel≥ 6.19, < 6.19.126.19.12
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (2)
EPSS history
Timeline
  • 01 MAY 14:15Z
    ALSA: ctxfi: Don't enumerate SPDIF1 at DAIO initialization
    cvelistv5