The bug arises when the f_audio_complete() routine copies a host‑controlled length value into a fixed‑size 4‑byte stack variable using memcpy. The req->length field is derived from the USB request sent by the host and is not bounded before the copy, leading to a stack out‑of‑bounds write that can corrupt kernel memory or crash the system. This flaw can be exploited by a malicious USB host to trigger arbitrary kernel memory corruption, potentially allowing privilege escalation or denial of service for users with local access.

All Linux kernel builds that enable the f_uac1_legacy USB gadget driver are potentially impacted. The vulnerability is present in the kernel source regardless of distribution, and no specific version range is provided in the advisory. Systems running a kernel that still includes the unpatched f_uac1_legacy implementation may be exposed.

The exploitation likelihood is not quantified in the advisory (EPSS not available; KEV not listed), but the flaw involves a stack buffer overflow which historically carries a high exploitation risk. The attack path would involve a USB host sending a crafted control request to the gadget device, which the kernel would process without validating the payload size. Based on the description, the attack vector is a host‑to‑device USB interface. While no CVSS score is given, the nature of the vulnerability suggests it could lead to kernel privilege escalation if successfully exploited.