The ALSA ctxfi driver contains a logic error that causes an infinite loop during the setup of an S/PDIF passthrough stream at 32 kHz. Because the PLL rate is uninitialized, the MSR calculation collapses to zero and the loop never terminates, consuming CPU cycles until the thread is killed. The flaw does not provide any data exfiltration, privilege escalation, or remote code execution capability; its primary effect is a loss of audio subsystem availability and overall system responsiveness.

All Linux kernel builds that include the ALSA ctxfi driver are affected. The vendor list contains only Linux; no specific kernel versions are listed, so any kernel compiling this driver path remains vulnerable.

The vulnerability holds a CVSS score of 5.5, and no EPSS metric is available. It is not included in the CISA KEV catalog. The likely attack vector is a local user or application that initiates an S/PDIF passthrough playback at 32 kHz. The attack requires the ability to play audio to the affected hardware, which is typically available to any authenticated user with audio output permissions. Once triggered, the infinite loop consumes CPU until it is interrupted, resulting in a denial‑of‑service for the audio subsystem and potentially the broader system. Remote exploitation is not plausible based on the available data.