What is CVE-2026-46049?

CVE-2026-46049 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.5 out of 10, affecting Linux kernel versions from 2.6.31 onward and patched in 5.10.258, 5.15.209, 6.1.175 and others. CVE-2026-46049 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2026-46049?

CVE-2026-46049 has a CVSS score of 5.5 out of 10, rated Medium severity. The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Is there a patch available for CVE-2026-46049?

Yes, CVE-2026-46049 has been patched. Fixed versions include 5.10.258, 5.15.209, 6.1.175 and others. If you are running Linux kernel 2.6.31 or later up to the fix versions, apply the relevant patch for your kernel branch.

Is CVE-2026-46049 actively exploited?

CVE-2026-46049 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

CVE-2026-46049

Medium

In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Add fallback to default RSR for S/PDIF spdif_passthru_playback_get_resources() uses atc->pll_rate as the RSR for the MSR calculation loop. However, pll_rate is only updated in atc_pll_init() and not in hw_pll_init(), so it remains 0 after the card init. When spdif_passthru_playback_setup() skips atc_pll_init() for 32000 Hz, (rsr * desc.msr) always becomes 0, causing the loop to spin indefinitely. Add fallback to use atc->rsr when atc->pll_rate is 0. This reflects the hardware state, since hw_card_init() already configures the PLL to the default RSR.

Package Linux Kernel

Published 2026-05-27

Last modified 2026-06-16

CVSS version 3.1

Patch available

Yes

CVSS 3.1 score

5.5

out of 10

Medium

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

High

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected versions

Linux kernel versions 2.6.31 and later are affected. Fixed in 5.10.258, 5.15.209, 6.1.175, 6.6.140, 6.12.86, 6.18.27, 7.0.4, 7.1 and their respective stable series.

Affected from

≥ 2.6.31

Fixed in

✓ 5.10.258 5.10.x ✓ 5.15.209 5.15.x ✓ 6.1.175 6.1.x ✓ 6.6.140 6.6.x ✓ 6.12.86 6.12.x ✓ 6.18.27 6.18.x ✓ 7.0.4 7.0.x ✓ 7.1

References

8 total

Kernel Git
https://git.kernel.org/stable/c/09496158f6ebba8830593f8972035c02f97124c1

Patch
Kernel Git
https://git.kernel.org/stable/c/25ded535ee261161bcf19dafd525c542e606559d

Patch
Kernel Git
https://git.kernel.org/stable/c/30f9494c6f2b53a78822cfb653ffbb1d092d44c8

Patch
Kernel Git
https://git.kernel.org/stable/c/615b7a5e5d8be68d52f262579906f7e015ba4606

Patch
Kernel Git
https://git.kernel.org/stable/c/7d61662197ecdc458e33e475b6ada7f6da61d364

Patch

Showing 5 of 8 references View all on NVD

Details

CVE ID CVE-2026-46049

Severity Medium

CVSS score 5.5 / 10

CVSS version 3.1

Published 2026-05-27

Modified 2026-06-16

KEV No

Patch

Yes

Package linux

Frequently asked questions

What is CVE-2026-46049?

CVE-2026-46049 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.5 out of 10 . It affects Linux kernel versions from 2.6.31 onward and has been patched in 5.10.258, 5.15.209, 6.1.175 and others. CVE-2026-46049 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
What is the CVSS score for CVE-2026-46049?

CVE-2026-46049 has a CVSS score of 5.5 out of 10, rated Medium severity (CVSS 3.1). The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
Is there a patch available for CVE-2026-46049?

Yes. CVE-2026-46049 has been patched. Fixed versions include 5.10.258, 5.15.209, 6.1.175 and others. If you are running Linux kernel 2.6.31 or later up to the fix versions, apply the relevant patch for your kernel branch.
Is CVE-2026-46049 actively exploited?

No. CVE-2026-46049 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.