Technical impact
The vulnerability stems from missing error handling when acquiring clocks in the AMD ACP audio driver. Without checking the return value of clk_get(), an invalid pointer may be returned and later dereferenced by the clock core, causing a kernel crash. This results in a denial of service by bringing the system down because the kernel panics rather than gracefully handling the failure.
Affected Systems
The flaw affects the Linux kernel driver stack for AMD ACP audio devices, specifically the acp_card_rt5682_init() and acp_card_rt5682s_init() functions. Any Linux installation that includes these drivers could be impacted. The exact kernel versions are not listed, so operators should assume all kernels before the patch are potentially vulnerable.
Risk and Exploitability
EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, indicating that public exploitation data is lacking. The CVSS score is 5.5, indicating medium severity. Based on the description, it is inferred that an attacker would need the ability to load or reinitialize the affected driver, which typically implies local access. The risk is high if the vulnerability can be triggered, as a kernel panic leads to a complete loss of service, but the likelihood of widespread exploitation remains uncertain due to the lack of known public exploits.
Debian DLA