The bug arises when the f_audio_complete() routine copies a host‑controlled length value into a fixed‑size 4‑byte stack variable using memcpy. The req->length field is derived from the USB request sent by the host and is not bounded before the copy, leading to a stack out‑of‑bounds write that can corrupt kernel memory or crash the system. This flaw can be exploited by a malicious USB host to trigger arbitrary kernel memory corruption, potentially allowing privilege escalation or denial of service for users with local access.

All Linux kernel builds that enable the f_uac1_legacy USB gadget driver are potentially impacted. The vulnerability is present in the kernel source regardless of distribution, and no specific version range is provided in the advisory. Systems running a kernel that still includes the unpatched f_uac1_legacy implementation may be exposed.

The exploitation likelihood is low according to the EPSS score of <1%, but the flaw still involves a stack buffer overflow that carries a high severity potential. The CVSS score of 7.8 reflects a high impact rating. An attacker would send a crafted control request from a USB host to the gadget device; the kernel, lacking size validation, copies the host‑provided length into a 4‑byte stack variable, allowing an out‑of‑bounds write that can corrupt kernel memory. The attack vector is via the USB host‑to‑device interface, and the vulnerability could enable kernel privilege escalation or denial of service should the overflow be successfully exploited.