CVE-2026-46262ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put()
- 5.5MediumCVSS base score
- 0.09%Exploitation in 30 daysEPSS · top 100% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() This reverts commit f51424872760 ("ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put()"). The original patch attempted to acquire the card->controls_rwsem lock in fsl_xcvr_mode_put(). However, this function is called from the upper ALSA core function snd_ctl_elem_write(), which already holds the write lock on controls_rwsem for the whole put operation. So there is no need to simply hold the lock for fsl_xcvr_activate_ctl() again. Acquiring the read lock while holding the write lock in the same thread results in a deadlock and a hung task, as reported by Alexander Stein.
Timeline
ID reserved
By Linux
- 21 days later
· 21 days later
Published
- 5 months later
· 5 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Analyzed | 3.1 | Medium5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.09% · top 100% of all CVEs (12 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.5.
Affected products
- affected 612ffe1f4f0499b3011f16d06e354a76dae2e2d1 – < ae5a70e3e87c28edbaf9939cfef1bcbd9615420f
- affected 38354c82abe7bcbcd1182a06af89d3cc16d3e2c7 – < 30ffcad5edb56947dccc26f6816ab7a55b21a711
- affected 61e007657bf7740d54ca2aadce0fb5997839818e – < 29b2fbe3498da3681a01b34e4a2259f8a1b89448
- affected daaf4fe333e0d48b2037cd2270bf1ff8f70d5068 – < b0f74f5d24fe3c73ef1369a811891198b54c1e8e
- affected cab928242853a832ffa7efda270ecfb9efeebb6e – < 9a2a5da002775376498e8814df4a87cd629a3a0c
- affected f514248727606b9087bc38a284ff686e0093abf1 – < 0886dc6326c3cc596799c4340d342898301cf52a
- affected f514248727606b9087bc38a284ff686e0093abf1 – < 9f16d96e1222391a6b996a1b676bec14fb91e3b2
- affected 5.15.201 – < 5.15.202
- affected 6.1.164 – < 6.1.165
- affected 6.6.127 – < 6.6.128
- affected 6.12.74 – < 6.12.75
- affected 6.18.13 – < 6.18.14
- affected 6.19
- unaffected < 6.19
- unaffected 5.15.202 – ≤ 5.15.*
- unaffected 6.1.165 – ≤ 6.1.*
- unaffected 6.6.128 – ≤ 6.6.*
- unaffected 6.12.75 – ≤ 6.12.*
- unaffected 6.18.14 – ≤ 6.18.*
- unaffected 6.19.4 – ≤ 6.19.*
- unaffected 7.0 – ≤ *
References
References7
- https://git.kernel.org/stable/c/ae5a70e3e87c28edbaf9939cfef1bcbd9615420f (opens in a new tab)
- https://git.kernel.org/stable/c/30ffcad5edb56947dccc26f6816ab7a55b21a711 (opens in a new tab)
- https://git.kernel.org/stable/c/29b2fbe3498da3681a01b34e4a2259f8a1b89448 (opens in a new tab)
- https://git.kernel.org/stable/c/b0f74f5d24fe3c73ef1369a811891198b54c1e8e (opens in a new tab)
- https://git.kernel.org/stable/c/9a2a5da002775376498e8814df4a87cd629a3a0c (opens in a new tab)
- https://git.kernel.org/stable/c/0886dc6326c3cc596799c4340d342898301cf52a (opens in a new tab)
- https://git.kernel.org/stable/c/9f16d96e1222391a6b996a1b676bec14fb91e3b2 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-34124 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-46262)Record last updated .