CVE-2026-31776
ALSA: ctxfi: Fix missing SPDIFI1 index handling
Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Fix missing SPDIFI1 index handling SPDIF1 DAIO type isn't properly handled in daio_device_index() for hw20k2, and it returned -EINVAL, which ended up with the out-of-bounds array access. Follow the hw20k1 pattern and return the proper index for this type, too.
INFO
Published Date :
May 1, 2026, 3:16 p.m.
Last Modified :
May 7, 2026, 2:27 a.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | [email protected] |
Solution
- Update the Linux kernel to the latest stable version.
- Apply the provided patch for ALSA: ctxfi.
- Recompile and install the kernel.
- Reboot the system.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-31776.
| URL | Resource |
|---|---|
| https://git.kernel.org/stable/c/950decf59d4e978b60a792ce0b3e1555a608f489 | Patch |
| https://git.kernel.org/stable/c/b045ab3dff97edae6d538eeff900a34c098761f8 | Patch |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-31776 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-31776
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-31776 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-31776 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
May. 07, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Added CWE CWE-129 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 6.19.12 Added Reference Type kernel.org: https://git.kernel.org/stable/c/950decf59d4e978b60a792ce0b3e1555a608f489 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/b045ab3dff97edae6d538eeff900a34c098761f8 Types: Patch -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 02, 2026
Action Type Old Value New Value Removed Reference https://git.kernel.org/stable/c/28222e13666b5d26bf66563c056069ed32f87b33 Removed Reference https://git.kernel.org/stable/c/57698f184e1afbe054b3cd30e2c43a67c11d7f5e Removed Reference https://git.kernel.org/stable/c/5b39985303a639b159dea306a032c08ef22f029d Removed Reference https://git.kernel.org/stable/c/a0b45bdfffce9894b39392d061c14fda24de8b67 Removed Reference https://git.kernel.org/stable/c/a3b0e5f84058a9c3d0542a71c2b3a7801e4ee26a Removed Reference https://git.kernel.org/stable/c/c8859675f1cf92fe2eb25ef525440702140a0b55 -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 01, 2026
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Fix missing SPDIFI1 index handling SPDIF1 DAIO type isn't properly handled in daio_device_index() for hw20k2, and it returned -EINVAL, which ended up with the out-of-bounds array access. Follow the hw20k1 pattern and return the proper index for this type, too. Added Reference https://git.kernel.org/stable/c/28222e13666b5d26bf66563c056069ed32f87b33 Added Reference https://git.kernel.org/stable/c/57698f184e1afbe054b3cd30e2c43a67c11d7f5e Added Reference https://git.kernel.org/stable/c/5b39985303a639b159dea306a032c08ef22f029d Added Reference https://git.kernel.org/stable/c/950decf59d4e978b60a792ce0b3e1555a608f489 Added Reference https://git.kernel.org/stable/c/a0b45bdfffce9894b39392d061c14fda24de8b67 Added Reference https://git.kernel.org/stable/c/a3b0e5f84058a9c3d0542a71c2b3a7801e4ee26a Added Reference https://git.kernel.org/stable/c/b045ab3dff97edae6d538eeff900a34c098761f8 Added Reference https://git.kernel.org/stable/c/c8859675f1cf92fe2eb25ef525440702140a0b55