In the Linux kernel ASoC Qualcomm q6asm driver, a flaw caused DSP responses to be processed even after an audio stream had been closed, resulting in kernel lockups. The driver failed to discard pending responses, leading to a state where the kernel waits indefinitely for an event that never arrives. This weakness is a classic example of a failure to check internal state before handling asynchronous responses. The consequence is a denial of service that removes normal operation until the system is rebooted.

The vulnerability impacts the Linux kernel’s qcom q6asm (ASoC) audio driver. No specific release numbers are listed, so any kernel version that includes the driver and predates the commit that unconditionally drops DSP responses may be affected.

CVSS score of 5.5, EPSS score < 1%, and no KEV listing are supplied. The main impact is a disruptive lockup that can be triggered by closing an audio stream and allowing residual DSP responses to be processed. Based on the description, it is inferred that the attack can be carried out from a local or privileged context by manipulating stream state. The EPSS score of < 1% indicates a very low exploitation probability, but the moderate severity denial of service nature makes the risk high for systems where an attacker can influence audio stream handling.