The ALSA USB‑audio driver in the Linux kernel incorrectly validates UAC3 header descriptors, using the UAC2 protocol version in its validator table. As a result, UAC3 devices bypass validation, allowing a malicious USB device to supply a truncated header that causes the driver to read beyond the bounds of the descriptor. This out‑of‑bounds read can lead to a crash, denial of service, and potentially expose memory contents, though no exploitation beyond denial of service is documented.

This issue affects the Linux kernel’s ALSA USB‑audio support. The specific kernel versions that contain the vulnerability are those that have not yet incorporated the fix for the UAC3 validator table; the problem was introduced before the commit that corrected a UAC3 typo, so kernels released prior to that fix are at risk. No explicit version list is provided, so any distribution shipping an older kernel should consider this vulnerability.

The CVSS score of 6.6 indicates medium severity, while the EPSS score of less than 1 % suggests a low likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a malicious USB device to be attached to a system running the vulnerable kernel; no public exploit code is known, making the risk primarily a potential denial‑of‑service rather than an immediate attack vector.