An out‑of‑bounds write in the ALSA USB audio driver occurs when a user sends audio data to the PCM playback stream with certain parameter combinations. The driver incorrectly calculates the number of frames, exceeding the allocated URB buffer size and writing beyond the bounds of kernel memory. This buffer overflow can corrupt critical kernel structures, potentially allowing a local attacker to execute arbitrary code or gain elevated privileges. The issue is identified as a CWE‑787.

Kernel versions affected include those before the patch commit referenced in the kernel module updates. Specifically, versions 4.4.229, 4.9.229, and the 6.19 release candidates from RC1 to RC5 are known to contain the flaw. All Linux kernel installations that still use these or earlier releases without the applied fix are potentially vulnerable, regardless of vendor.

The CVSS score of 7.8 reflects a high severity, yet the EPSS rating of less than 1% indicates a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a local user with the ability to write to the ALSA PCM device, so the attack surface is limited to systems where audio drivers are exposed to untrusted users. When present, the kernel memory corruption could be leveraged for privilege escalation to root.