CVE-2026-46262: Linux Kernel fsl_xcvr Audio Driver Deadlock Vulnerability

Technical summary

CVE-2026-46262 addresses a lock re-entrancy issue in fsl_xcvr_mode_put(), a handler for audio control parameter changes in the Freescale XCVR audio transceiver driver. A prior patch (commit f51424872760) added a call to acquire card->controls_rwsem in read mode within fsl_xcvr_mode_put(). However, the caller—snd_ctl_elem_write() in the ALSA core—already holds the write lock on controls_rwsem. Attempting to acquire a read lock while holding the write lock in the same thread triggers a deadlock condition, manifesting as a hung task. The vulnerability is classified under CWE-667 (improper locking), and resolution requires reverting the problematic lock acquisition call.

Business impact

Systems running affected Linux kernel versions experience audio subsystem failures when users attempt to modify XCVR audio control parameters. This results in hung tasks and potential system instability, particularly on embedded and automotive platforms that rely on Freescale XCVR hardware. Services dependent on audio functionality become unresponsive, and in some environments, the hung task may trigger watchdog timeouts leading to unplanned reboots.

Affected systems

The vulnerability affects the Linux kernel across all branches where the problematic commit f51424872760 was applied. This impacts systems using Freescale/NXP XCVR audio transceiver hardware, commonly found in embedded systems, automotive head units, and IoT devices. Desktop and server systems without fsl_xcvr hardware are unaffected by this specific issue. The ASoC subsystem is kernel-mode only, so exploitation requires local access to audio control configuration.

Exploitability

Exploitability is limited. The vulnerability requires local access to the system and the ability to trigger ALSA audio control writes—typically available to unprivileged local users. A standard user can cause the deadlock by modifying audio settings through normal audio configuration utilities (e.g., amixer, pulseaudio, ALSA control applications). No network access or privilege escalation is necessary. However, this is a Denial of Service mechanism rather than a code execution or privilege escalation vector. The CVSS score of 5.5 (MEDIUM) reflects high availability impact but low confidentiality and integrity risk.

Remediation

Apply the kernel security update that reverts commit f51424872760. The fix removes the problematic lock acquisition call in fsl_xcvr_mode_put(), trusting the ALSA core's existing locking semantics. Systems should upgrade to a patched kernel version provided by their Linux distribution or vendor. For distributions, verify the kernel version that includes this fix against the vendor advisory.

Patch guidance

Check your kernel version against your Linux distribution's security advisory for CVE-2026-46262. Most distributions (Red Hat, Debian, Ubuntu, SUSE, etc.) will provide updated kernel packages. Apply the update through your standard package management system (yum, apt, zypper, etc.). For custom or self-compiled kernels, apply the revert patch or ensure commit f51424872760 is not present in your kernel tree. Recompile and reboot to activate the fix. Verify the patch is applied by checking that fsl_xcvr_mode_put() does not explicitly call down_read() on controls_rwsem.

Detection guidance

Monitor system logs for 'task hung' or 'RCU stall' messages in dmesg output, particularly those referencing audio or ALSA subsystems. Use kernel tracing tools (ftrace, SystemTap) to capture lock contention in the fsl_xcvr and ALSA core drivers. If you suspect the vulnerability, attempt to reproduce by running 'amixer set' commands on XCVR controls; a hung process is diagnostic. For proactive detection on running systems, audit running kernel version against known-vulnerable releases from your vendor. Tools like 'uname -r' and distribution-specific version queries establish baseline compliance.

Why prioritize this

Prioritize this vulnerability for systems using Freescale XCVR hardware in production audio or automotive applications where availability is critical. The local-only attack vector and requirement for active audio control changes limit enterprise data center risk but increase risk for embedded/IoT deployments. The MEDIUM CVSS score and high availability impact make this a standard-priority patch for affected product lines; defer only if audio hardware is disabled or unused. Enterprises without fsl_xcvr deployments may deprioritize in favor of higher-severity vulnerabilities.

Risk score, explained

CVSS 3.1 score of 5.5 (MEDIUM) reflects: Attack Vector Local (L) and Attack Complexity Low (L)—any local user can trigger via standard ALSA tools; Privileges Required (L)—unprivileged user; User Interaction None (N); Scope Unchanged; Confidentiality None (N); Integrity None (N); Availability High (H)—the deadlock halts audio subsystem and can hang the kernel. The score appropriately weights the DoS severity against the limited attack scope and zero impact to data confidentiality or integrity.

Frequently asked questions