The vulnerability resides in the Linux kernel’s ALSA USB subsystem for the TASCAM US-144MKII device. When a device presents a configuration that declares interface 1 but omits interface 0, the kernel call usb_ifnum_to_if(dev, 0) returns NULL. This NULL pointer is dereferenced without a preceding validity check, causing a kernel panic. The resulting crash leads to a denial of service; no other impact such as privilege escalation is documented.

All Linux kernels that include the ALSA USB driver prior to the patch commit are affected. The vendor is the Linux kernel (generic). No specific kernel version ranges are listed, so any kernel before the fix can be considered vulnerable.

The CVSS score of 4.6 indicates medium severity. The EPSS score of <1% shows exploitation probability is very low. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker must physically connect a malicious USB device to the target system to trigger the crash. The impact is a kernel panic resulting in a system reboot and loss of service; no privilege escalation is described.