Linux Kernel EUVD-2026-26590

Exploitation requires all of the following: (1) Local system access as an authenticated user with standard privileges (PR:L per CVSS vector), (2) The ctxfi kernel module must be loaded (not present on systems without Creative X-Fi hardware or with the module explicitly disabled), (3) A Creative Sound Blaster X-Fi audio device must be present and detected by the system, or the driver must be actively in use. Exploitation does NOT require root privileges, user interaction (UI:N), or network access. The vulnerability is NOT exploitable remotely, cannot affect systems without the ctxfi driver, and is limited to systems with specific Creative audio hardware or driver configurations. Non-default mitigation: systems running minimal audio configurations or server deployments without audio hardware are unaffected.

CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) indicates a local, low-complexity denial of service requiring authenticated access with no user interaction needed. The attack is confined to the local system (Scope:Unchanged) with no impact to confidentiality or integrity, only availability. EPSS score of 0.02% (percentile 5%) represents minimal practical exploitation probability despite the moderate CVSS score - this aligns with the attack vector requirement (local access only) and the specific nature of the vulnerability (requires ctxfi driver loaded and audio device present). No KEV listing or public POC identified suggests this is not actively exploited in the wild. This is a legitimate but low-priority vulnerability from a risk prioritization perspective: the CVSS score reflects the availability impact when triggered, but real-world risk is constrained by local-only access and hardware-specific requirements. Defenders should treat this as standard patching priority rather than critical.

A local authenticated user (standard privilege level, non-root) triggers the vulnerability by attempting to initialize or reconfigure the ctxfi audio driver when a Creative X-Fi audio device is present. The user might invoke audio configuration tools, reload the kernel module with specific parameters, or interact with ALSA control interfaces that invoke daio_device_index(). When the function returns an unexpected error value without being checked, the driver fails to handle the error gracefully, leading to a kernel warning, audio subsystem crash, or system instability.