The vulnerability resides in the ALSA ctxfi driver’s audio mixer code where a configuration field is used as a loop counter without proper bounds checking. The code may read past the end of a static 8‑byte array, exposing the system to a memory corruption fault. This can trigger a crash or, in some configurations, may allow an attacker to read or influence memory, potentially leading to information disclosure or arbitrary code execution if exploited against a privileged context. The weakness is identified as CWE‑125, an out‑of‑bounds read error.

Linux kernel versions up to 6.19 (including all release candidates) are affected. The kernel is maintained by the Linux Foundation and the source is available on the primary Git kernel repository. No vendor‑specific product list is required beyond the Linux kernel itself.

The CVSS score of 7.1 reflects a high impact and a medium level of exploit complexity. The EPSS probability is less than 1%, indicating that active exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog, and no known public exploits exist. Attackers would likely need to trigger the vulnerable code path, which requires access to the ALSA ctxfi driver, typically via privileged media or audio subsystem interactions.