CVE-2026-31776 - Vulnerability Details

- ALSA: ctxfi: Fix missing SPDIFI1 index handling

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: ctxfi: Fix missing SPDIFI1 index handling

SPDIF1 DAIO type isn't properly handled in daio_device_index() for
hw20k2, and it returned -EINVAL, which ended up with the out-of-bounds
array access. Follow the hw20k1 pattern and return the proper index
for this type, too.

Published: 2026-05-01

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The ALSA ctxfi driver failed to handle the SPDIF1 DAIO type correctly, causing daio_device_index() to return an erroneous index for hw20k2. This caused an out‐of‐bounds array access, which can corrupt kernel memory. The corruption may lead to a system crash or other instability effects. This is a Buffer Access with Incorrect Index (CWE‑1285) and also maps to CWE‑129.

Affected Systems

All Linux kernel builds that contain the ALSA ctxfi driver and have not been patched for this issue are affected. No specific kernel release numbers are listed in the available data.

Risk and Exploitability

The vulnerability has a CVSS score of 7.8 and an EPSS score of < 1%, indicating a very low probability of exploitation. It is not listed in the CISA KEV catalog. As an out-of-bounds array access in kernel space, the exploit is likely to require local access and may lead to kernel memory corruption, potentially causing a system crash or denial of service.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`a2dbaeb5c61ef110ceefe0d48fe94d428d3bcf16`	affected	< 950decf59d4e978b60a792ce0b3e1555a608f489
`a2dbaeb5c61ef110ceefe0d48fe94d428d3bcf16`	affected	< b045ab3dff97edae6d538eeff900a34c098761f8

Linux

affected

Version	Status	Constraints
`6.19`	affected	—
`0`	unaffected	< 6.19
`6.19.12`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc2::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc3::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc4::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc5::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc6::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,a3b0e5f84058a9c3d0542a71c2b3a7801e4ee26a)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,28222e13666b5d26bf66563c056069ed32f87b33)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,5b39985303a639b159dea306a032c08ef22f029d)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,c8859675f1cf92fe2eb25ef525440702140a0b55)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,a0b45bdfffce9894b39392d061c14fda24de8b67)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,57698f184e1afbe054b3cd30e2c43a67c11d7f5e)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,950decf59d4e978b60a792ce0b3e1555a608f489)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,b045ab3dff97edae6d538eeff900a34c098761f8)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[5.10.253,6.0.0)`	unaffected	semver	—
`[5.15.203,5.16.0)`	unaffected	semver	—
`[6.1.168,6.2.0)`	unaffected	semver	—
`[6.6.134,6.7.0)`	unaffected	semver	—
`[6.12.81,6.13.0)`	unaffected	semver	—
`[6.18.22,6.19.0)`	unaffected	semver	—
`[6.19.12,6.20.0)`	unaffected	semver	—
`[0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to the latest release that contains the fix for SPDIFI1 index handling.
Reboot the system to load the patched kernel and ensure the ALSA ctxfi driver is fully updated.
If the patch cannot be applied immediately, disable SPDIF functionality or unload the ALSA ctxfi module to prevent the out-of-bounds access from occurring.

Generated by OpenCVE AI on May 7, 2026 at 04:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4561-1	linux-6.1 security update
Debian DSA	DSA-6243-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00015.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/950decf59d4e978b60a792ce0b3e1555a608f489
https://git.kernel.org/stable/c/b045ab3dff97edae6d538eeff900a34c098761f8
https://lore.kernel.org/linux-cve-announce/2026050150-CVE-2026-31776-8e0f@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-31776
https://www.cve.org/CVERecord?id=CVE-2026-31776

History

Thu, 07 May 2026 02:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-129
CPEs		cpe:2.3:o:linux:linux_kernel:7.0:rc1:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc2:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc3:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc4:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc5:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc6::::::
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 02 May 2026 15:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-129

Sat, 02 May 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-1285
References		https://lore.kernel.org/linux-cve-announce/2026050150-CVE-2026-31776-8e0f@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-31776 https://www.cve.org/CVERecord?id=CVE-2026-31776
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Sat, 02 May 2026 07:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-129

Sat, 02 May 2026 07:30:00 +0000

Type	Values Removed	Values Added
References	https://git.kernel.org/stable/c/28222e13666b5d26bf66563c056069ed32f87b33 https://git.kernel.org/stable/c/57698f184e1afbe054b3cd30e2c43a67c11d7f5e https://git.kernel.org/stable/c/5b39985303a639b159dea306a032c08ef22f029d https://git.kernel.org/stable/c/a0b45bdfffce9894b39392d061c14fda24de8b67 https://git.kernel.org/stable/c/a3b0e5f84058a9c3d0542a71c2b3a7801e4ee26a https://git.kernel.org/stable/c/c8859675f1cf92fe2eb25ef525440702140a0b55

Fri, 01 May 2026 14:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Fix missing SPDIFI1 index handling SPDIF1 DAIO type isn't properly handled in daio_device_index() for hw20k2, and it returned -EINVAL, which ended up with the out-of-bounds array access. Follow the hw20k1 pattern and return the proper index for this type, too.
Title		ALSA: ctxfi: Fix missing SPDIFI1 index handling
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/28222e13666b5d26bf66563c056069ed32f87b33 https://git.kernel.org/stable/c/57698f184e1afbe054b3cd30e2c43a67c11d7f5e https://git.kernel.org/stable/c/5b39985303a639b159dea306a032c08ef22f029d https://git.kernel.org/stable/c/950decf59d4e978b60a792ce0b3e1555a608f489 https://git.kernel.org/stable/c/a0b45bdfffce9894b39392d061c14fda24de8b67 https://git.kernel.org/stable/c/a3b0e5f84058a9c3d0542a71c2b3a7801e4ee26a https://git.kernel.org/stable/c/b045ab3dff97edae6d538eeff900a34c098761f8 https://git.kernel.org/stable/c/c8859675f1cf92fe2eb25ef525440702140a0b55

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-05-01T14:15:04.423Z

Updated: 2026-05-11T22:15:35.385Z

Reserved: 2026-03-09T15:48:24.140Z

Link: CVE-2026-31776

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-05-01T15:16:40.967

Modified: 2026-05-07T02:27:43.700

Link: CVE-2026-31776

Redhat

Severity : Moderate

Publid Date: 2026-05-01T00:00:00Z

Links: CVE-2026-31776 - Bugzilla

OpenCVE Enrichment

Updated: 2026-05-07T04:15:21Z

Weaknesses

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object