The Linux kernel ALSA OSS mixer layer performs control operations independently, which may allow pending calls to be missed during device disconnection. This oversight can create a use‑after‑free (UAF) condition, potentially leading to kernel memory corruption. Based on the nature of a use‑after‑free bug, it is inferred that an attacker could exploit this to achieve privilege escalation or trigger a kernel panic, although such outcomes are not explicitly stated in the advisory.

All Linux kernel releases that include the OSS mixer code and lack the recent patch adding card‑disconnect checkpoints. The vulnerability is present in the core ALSA subsystem of any distribution running those kernel versions.

The CVSS score of 5.5 reflects moderate severity. No EPSS score is available, indicating limited publicly reported exploitation activity. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is through local use of the ALSA OSS mixer interface, which is common for users or applications that interact with audio devices; this inference is based on the description that the issue occurs during device disconnection.