The ALSA aloop driver in the Linux kernel contains a race between checking the PCM state and stopping a tied substream. Because these operations occur outside the cable lock, frequent trigger calls while the substream is opened or closed can lead to a use‑after‑free in the kernel. A use‑after‑free allows an attacker to corrupt kernel memory and may result in a crash or in the execution of arbitrary code with kernel privileges. The vulnerability is limited to the ALSA loopback device and requires the ability to trigger it, typically through a user‑space audio program.

All Linux kernel builds are affected until the patch that surrounds the critical code with a spin‑lock and adds null checks is applied. The patch appears in kernel 6.19 releases and backported to earlier releases. Devices running Linux kernels other than the patched versions expose the loopback driver to the race condition described above.

The CVSS score of 7.8 indicates high severity, but the EPSS score of less than 1% signals that the likelihood of exploitation is low at present. The vulnerability is local, requiring a program with access to the ALSA loopback device; it is not remotely exploitable. Because it is not listed in the CISA KEV catalog, there is no widespread evidence of active exploitation. Nevertheless, the potential for privilege escalation or service disruption warrants prompt mitigation.