A null pointer dereference was discovered in the Advanced Linux Sound Architecture (ALSA) driver for the TLV320ADCX140 audio codec. The driver incorrectly accessed a component pointer that was never initialized, which could cause the kernel to dereference a null pointer and panic. This vulnerability produces a system crash and results in an outage of the affected machine.

The flaw is present in the Linux kernel across all 6.1 releases and in the 6.19 development releases up to and including 6.19 rc8. Any system running these kernel versions and using the ALSA driver for the TLV320ADCX140 codec is vulnerable. The issue is not specific to a particular vendor but affects all builds of the Linux kernel that include the affected source code.

The CVSS score of 5.5 indicates medium severity. The EPSS score of less than 1% reflects a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Because this condition occurs during kernel initialization and requires the compromised device to load or use the affected driver, an attacker would need local or kernel‑level privileges. Therefore the primary impact is a denial‑of‑service scenario rather than remote code execution.