The vulnerability arises when the Linux kernel’s ASoC simple‑card utilities release a device node prematurely by calling __free(device_node) within graph_util_parse_dai(). This mismanagement of memory can lead to a use‑after‑free condition, potentially causing the kernel to crash or behave unpredictably, which in turn could be leveraged for denial of service or, in certain circumstances, by an attacker with local privileges to target kernel memory. The primary impact is a loss of availability and a risk of kernel memory corruption.

All Linux kernel releases that include the ASoC simple‑card command utilities are potentially affected. The CVE does not list specific kernel versions or patches, so the vulnerability applies broadly to any build that contains the unpatched code path in graph_util_parse_dai(). It is not limited to a particular distribution or vendor beyond the Linux kernel itself.

With a CVSS score of 5.5 the vulnerability is considered moderate in severity. The EPSS score of less than 1% indicates that the overall probability of exploitation is very low, and the vulnerability is not currently listed in CISA’s KEV catalog. The attack vector is likely local or requires privileged execution, so compromising the system is required for an attacker to exploit the flaw. Given the low exploitation probability and the availability of a patch, the risk to most users remains low, though a kernel crash would result in a denial of service for affected users.