A flaw in ALSA’s usb‑audio driver allows the kernel to copy data from a USB packet into a playback buffer without checking that the packet size matches the expected buffer length. When the size of a capture stream packet differs from the playback stream, the driver writes past the end of the buffer, triggering a kernel Oops. This results in a crash of the operating system, allowing an attacker to disrupt service. The vulnerability is a classic out‑of‑bounds write and can be exploited by supplying malformed USB audio data to the system.

The bug exists in the Linux kernel’s ALSA usb‑audio subsystem. No vendor or product name is more specific than Linux kernel, and the affected versions are not listed in the data provided. All kernel releases that compile any of the exposed usb‑audio functions prior to the fix are potentially vulnerable.

The CVSS score of 7.8 indicates high severity, but the impact of a kernel crash is severe, leading to denial of service. The EPSS score of < 1% suggests a low probability that this exploit is widely used, and the flaw is not listed in CISA’s KEV catalog, indicating no known public exploits. Because the vulnerability is triggered by malformed USB packets, an attacker with physical or any USB access to the target device can directly cause the fault. The risk is high for devices that accept USB audio input—especially unattended servers or embedded systems—while for systems without exposed USB audio support the risk is lower. The lack of a public exploit at present does not remove the need for remediation, as the ability to crash a kernel is sufficient to damage availability and may serve as a foothold for further compromise if privilege escalation is found elsewhere.