The vulnerability resides in the Linux kernel’s sound subsystem driver for the nau8821 codec; attempting to unload the driver while an asynchronous jack‑detection work item remains pending can result in a kernel panic. When the delayed work eventually executes it dereferences a stale or invalid pointer, causing a page fault that brings the whole system down. The immediate consequence is a denial‑of‑service, as the affected machine becomes unusable until a reboot.

Linux kernel builds that include the nau8821 driver prior to any fixes are affected. Any system where the driver module can be unloaded by a local user—typically a root account—faces the risk. The advisory does not list specific kernel versions, so any release shipping the unpatched driver is potentially vulnerable.

The CVSS score of 5.5 is reported, and the EPSS score is unavailable; the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a privileged local user who can unload the module; no remote or network attack vector is described. If an attacker succeeds, the result is an immediate kernel crash and service interruption. The attack surface is limited to systems where the driver is present and can be removed by the attacker.