A flaw in the ALSA Firewire driver causes a device-supplied status value to be used as an index into a fixed-length string array without proper bounds checking. The status field can be any 32‑bit value, and if it lies outside the array of 17 valid entries, the kernel accesses memory beyond the array bounds, potentially leading to a kernel fault or memory disclosure. The weakness is a bounds checking failure (CWE-1285). The vulnerability does not provide remote code execution, but it can trigger a system crash, resulting in a denial‑of‑service condition.

All Linux kernel installations that load the ALSA Firewire driver – including the firewire-core, firewire-ohci, and associated ALSA firewire modules – are affected. Any distribution that includes these modules, regardless of the specific kernel release, remains vulnerable until the patch is applied.

The CVSS score of 5.5 indicates a medium severity. The EPSS score of less than 1 % shows a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need physical or local access to a FireWire device connected to the system to provide a crafted status value. The likely attack vector is local via hardware device, making the exploitation more restrictive than remote attacks.