A malformed USB descriptor can trigger a null pointer dereference in the ALSA USB‑audio driver when parsing the Scarlett2 mixer interface. The driver assumes an endpoint is always present, leading to a kernel crash if that assumption fails. This problem relates to improper validation of input data (CWE‑130), resulting in denial of service on the affected system.

All Linux kernel releases that ship the ALSA USB‑audio driver with the Scarlett2 mixer quirk are affected. No specific version cutoff is given, so any installation that enables this quirk remains vulnerable until the endpoint number check is applied.

The CVSS score of 5.5 indicates medium severity, while an EPSS score of less than 1% reflects a low probability of widespread exploitation. The likely attack vector requires an attacker to supply a crafted USB audio device that can reach the target, typically through a local or compromised USB port. No public exploits have been documented and the vulnerability is not listed in CISA’s KEV catalog, but the kernel crash nature makes it attractive to actors with access to USB devices.