CVE-2026-46262

In the Linux kernel, the following vulnerability has been resolved: ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() This reverts commit f51424872760 ("ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put()"). The original patch attempted to acquire the card->controls_rwsem lock in fsl_xcvr_mode_put(). However, this function is called from the upper ALSA core function snd_ctl_elem_write(), which already holds the write lock on controls_rwsem for the whole put operation. So there is no need to simply hold the lock for fsl_xcvr_activate_ctl() again. Acquiring the read lock while holding the write lock in the same thread results in a deadlock and a hung task, as reported by Alexander Stein.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/0886dc6326c3cc596799c4340d342898301cf52a	Patch
https://git.kernel.org/stable/c/29b2fbe3498da3681a01b34e4a2259f8a1b89448	Patch
https://git.kernel.org/stable/c/30ffcad5edb56947dccc26f6816ab7a55b21a711	Patch
https://git.kernel.org/stable/c/9a2a5da002775376498e8814df4a87cd629a3a0c	Patch
https://git.kernel.org/stable/c/9f16d96e1222391a6b996a1b676bec14fb91e3b2	Patch
https://git.kernel.org/stable/c/ae5a70e3e87c28edbaf9939cfef1bcbd9615420f	Patch
https://git.kernel.org/stable/c/b0f74f5d24fe3c73ef1369a811891198b54c1e8e	Patch

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:5.15.201:::::::*
	cpe:2.3:o:linux:linux_kernel:6.1.164:::::::*
	cpe:2.3:o:linux:linux_kernel:6.6.127:::::::*
	cpe:2.3:o:linux:linux_kernel:6.12.74:::::::*
	cpe:2.3:o:linux:linux_kernel:6.18.13:::::::*
	cpe:2.3:o:linux:linux_kernel:6.19:-::::::

History

No history.

Information

Published : 2026-06-03 18:16

Updated : 2026-07-22 20:10

NVD link : CVE-2026-46262

Mitre link : CVE-2026-46262

CVE.ORG link : CVE-2026-46262

JSON object : View

Products Affected

linux

linux_kernel

CWE

CWE-667

Improper Locking

{"id": "CVE-2026-46262", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "612ffe1f4f0499b3011f16d06e354a76dae2e2d1", "lessThan": "ae5a70e3e87c28edbaf9939cfef1bcbd9615420f", "versionType": "git"}, {"status": "affected", "version": "38354c82abe7bcbcd1182a06af89d3cc16d3e2c7", "lessThan": "30ffcad5edb56947dccc26f6816ab7a55b21a711", "versionType": "git"}, {"status": "affected", "version": "61e007657bf7740d54ca2aadce0fb5997839818e", "lessThan": "29b2fbe3498da3681a01b34e4a2259f8a1b89448", "versionType": "git"}, {"status": "affected", "version": "daaf4fe333e0d48b2037cd2270bf1ff8f70d5068", "lessThan": "b0f74f5d24fe3c73ef1369a811891198b54c1e8e", "versionType": "git"}, {"status": "affected", "version": "cab928242853a832ffa7efda270ecfb9efeebb6e", "lessThan": "9a2a5da002775376498e8814df4a87cd629a3a0c", "versionType": "git"}, {"status": "affected", "version": "f514248727606b9087bc38a284ff686e0093abf1", "lessThan": "0886dc6326c3cc596799c4340d342898301cf52a", "versionType": "git"}, {"status": "affected", "version": "f514248727606b9087bc38a284ff686e0093abf1", "lessThan": "9f16d96e1222391a6b996a1b676bec14fb91e3b2", "versionType": "git"}, {"status": "affected", "version": "5.15.201", "lessThan": "5.15.202", "versionType": "semver"}, {"status": "affected", "version": "6.1.164", "lessThan": "6.1.165", "versionType": "semver"}, {"status": "affected", "version": "6.6.127", "lessThan": "6.6.128", "versionType": "semver"}, {"status": "affected", "version": "6.12.74", "lessThan": "6.12.75", "versionType": "semver"}, {"status": "affected", "version": "6.18.13", "lessThan": "6.18.14", "versionType": "semver"}], "programFiles": ["sound/soc/fsl/fsl_xcvr.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.19"}, {"status": "unaffected", "version": "0", "lessThan": "6.19", "versionType": "semver"}, {"status": "unaffected", "version": "5.15.202", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.165", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.128", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.75", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.14", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.4", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["sound/soc/fsl/fsl_xcvr.c"], "defaultStatus": "affected"}]}], "published": "2026-06-03T18:16:27.513", "references": [{"url": "https://git.kernel.org/stable/c/0886dc6326c3cc596799c4340d342898301cf52a", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/29b2fbe3498da3681a01b34e4a2259f8a1b89448", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/30ffcad5edb56947dccc26f6816ab7a55b21a711", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/9a2a5da002775376498e8814df4a87cd629a3a0c", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/9f16d96e1222391a6b996a1b676bec14fb91e3b2", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/ae5a70e3e87c28edbaf9939cfef1bcbd9615420f", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/b0f74f5d24fe3c73ef1369a811891198b54c1e8e", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-667"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put()\n\nThis reverts commit f51424872760 (\"ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put()\").\n\nThe original patch attempted to acquire the card->controls_rwsem lock in\nfsl_xcvr_mode_put(). However, this function is called from the upper ALSA\ncore function snd_ctl_elem_write(), which already holds the write lock on\ncontrols_rwsem for the whole put operation. So there is no need to simply\nhold the lock for fsl_xcvr_activate_ctl() again.\n\nAcquiring the read lock while holding the write lock in the same thread\nresults in a deadlock and a hung task, as reported by Alexander Stein."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nASoC: fsl_xcvr: Revertir correcci\u00f3n de bloqueo faltante en fsl_xcvr_mode_put()\n\nEsto revierte el commit f51424872760 ('ASoC: fsl_xcvr: corregir bloqueo faltante en fsl_xcvr_mode_put()').\n\nEl parche original intent\u00f3 adquirir el bloqueo card->controls_rwsem en fsl_xcvr_mode_put(). Sin embargo, esta funci\u00f3n es llamada desde la funci\u00f3n central superior de ALSA snd_ctl_elem_write(), que ya mantiene el bloqueo de escritura en controls_rwsem para toda la operaci\u00f3n 'put'. As\u00ed que no hay necesidad de simplemente mantener el bloqueo para fsl_xcvr_activate_ctl() de nuevo.\n\nAdquirir el bloqueo de lectura mientras se mantiene el bloqueo de escritura en el mismo hilo resulta en un interbloqueo y una tarea colgada, seg\u00fan lo informado por Alexander Stein."}], "lastModified": "2026-07-22T20:10:00.127", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "411B9362-5B74-4569-8450-50CAD50DE99C", "versionEndExcluding": "6.19.4", "versionStartIncluding": "6.19.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.15.201:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3873509D-CFDC-4039-9A16-64648274E54D"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.1.164:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8841C0DA-359F-4C10-8F51-9494CC682F61"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.6.127:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6F686B00-599C-4C3E-B874-A3725ADF8B50"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.12.74:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6E601D5F-7735-4B9F-B177-8317F642EC01"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.18.13:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7FBB74D9-EA97-4AD2-B9D8-DC505C2E45DE"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "35C8A871-4971-433E-A046-FC9F7B7D190A"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}