The ALSA USB‑audio driver in the Linux kernel validates UAC3 header descriptors using the wrong protocol version, UAC_VERSION_2 instead of UAC_VERSION_3. As a result, UAC3 devices bypass validation and can supply a truncated header. When the driver later accesses fields of this unvalidated descriptor, it performs an out‑of‑bounds read. The flaw can lead to a crash or denial of service.

The vulnerability is present in Linux kernel ALSA USB‑audio support in all kernel releases that did not include the fix for the UAC3 validator table. Kernels before the commit that corrected the UAC2/UAC3 copy‑paste error are at risk. Specific affected versions are not listed, so any distribution shipping an older kernel should review its kernel changelog for the relevant commit.

The CVSS score of 7.1 indicates high severity, while the EPSS score of less than 1 % suggests a low likelihood of wide exploitation. The flaw is not listed in the CISA KEV catalog. Exploitation requires a malicious USB device to be attached to a vulnerable system. No public exploit code is known, so the primary risk is denial of service rather than remote code execution.