High 7.8Published May 1, 2026

CVE-2026-31776ALSA: ctxfi: Fix missing SPDIFI1 index handling

Updated under an hour ago (Oct 27, 2026, 6:30 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Fix missing SPDIFI1 index handling SPDIF1 DAIO type isn't properly handled in daio_device_index() for hw20k2, and it returned -EINVAL, which ended up with the out-of-bounds array access. Follow the hw20k1 pattern and return the proper index for this type, too.

CVSS: 7.8 HIGH (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from a2dbaeb5c61ef110ceefe0d48fe94d428d3bcf16 before 950decf59d4e978b60a792ce0b3e1555a608f489; from a2dbaeb5c61ef110ceefe0d48fe94d428d3bcf16 before b045ab3dff97edae6d538eeff900a34c098761f8	CNA record
linux linux_kernel linux:linux_kernel	from 6.19 before 6.19.12; 7.0; 7.0; 7.0; 7.0; 7.0; 7.0	NVD

References

References

https://git.kernel.org/stable/c/950decf59d4e978b60a792ce0b3e1555a608f489	patch
https://git.kernel.org/stable/c/b045ab3dff97edae6d538eeff900a34c098761f8	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.