When the ALSA ctxfi driver initializes, it now loops over all DAIOTYP entries instead of just the supported ones. The last entry, SPDIF1, is only defined for a specific hardware model (hw20k1). On hardware that lacks this definition (such as hw20k2), the driver attempts to use a non‑existent description, causing a kernel panic. The crash leads to an immediate denial of service until the system is rebooted. This weakness is caused by lack of validation when accessing hardware‑specific resources, effectively an out‑of‑bounds array access or missing error handling.

The vulnerability applies to Linux kernels that include the refactored xfi driver without the recent commit that skips SPDIF1. It specifically impacts systems that load the ALSA ctxfi audio driver on hardware platforms that do not support SPDIF1, such as the hw20k2 model. The exact kernel release vector is not listed, so any build prior to the patch is potentially affected.

The flaw can cause a kernel crash, compromising system availability. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. The attack vector is local; it would be triggered during the audio subsystem initialization at boot or when the driver is loaded, requiring kernel‑mode execution. Because the issue is internal to the driver, it does not directly expose data but results in a system outage.