CVE-2026-46049
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
A vulnerability has been identified in the Linux kernel within the ALSA module that may lead to an infinite loop due to the lack of pll_rate updates. The issue occurs when spdif_passthru_playback_setup() skips atc_pll_init() for a frequency of 32000 Hz.
Risk Assessment
Organizations may experience performance and stability issues, potentially leading to service interruptions in audio services. The infinite loop may also result in increased consumption of system resources.
Recommendation
It is recommended to update the Linux kernel to the latest version to patch this vulnerability and avoid performance issues. Monitoring the system for abnormal audio service behavior is also advisable.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Add fallback to default RSR for S/PDIF spdif_passthru_playback_get_resources() uses atc->pll_rate as the RSR for the MSR calculation loop. However, pll_rate is only updated in atc_pll_init() and not in hw_pll_init(), so it remains 0 after the card init. When spdif_passthru_playback_setup() skips atc_pll_init() for 32000 Hz, (rsr * desc.msr) always becomes 0, causing the loop to spin indefinitely. Add fallback to use atc->rsr when atc->pll_rate is 0. This reflects the hardware state, since hw_card_init() already configures the PLL to the default RSR.