The flaw is a use‑after‑free that occurs when the ASoC qcom q6apm component registers its dynamic DAIs via managed APIs during driver initialization. Because both the component and its dynamic interfaces are allocated with the device-managed API, the kernel frees the DAIs before the component releases its references. The result is a memory corruption that can trigger a kernel panic or allow an attacker to execute arbitrary code if they can crash the kernel or manipulate freed memory. The KASAN trace attached to the advisory confirms the problematic free order and potential kernel crash.

Every Linux kernel that ships the ASoC qcom q6apm driver is potentially vulnerable, regardless of distribution. No specific kernel patch level is listed, but all builds that include the vulnerable component and its dynamic registration code are impacted until the fix that moves the component to unmanaged allocation is applied.

The CVSS score of 7.8 indicates high severity. The EPSS score is reported as less than 1 %, suggesting that while exploitation is possible, it is considered low‑probability under current data. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local: an attacker would need the ability to unload or reload the driver, or to load a malicious kernel module that interacts with q6apm, in order to trigger the problematic free order. If successfully exploited, the defective free order could lead to denial of service or, if the attacker can influence corrupted data structures, privilege escalation.