The Linux kernel's ALSA caiaq driver contains a flaw where a pending USB Request Block (URB) named ep1_in_urb may remain allocated when the setup_card() function encounters an error. Because the kernel does not cancel or free this URB on the error path, the resource can leak, consuming kernel memory and potentially degrading system stability or leading to a denial of service. This flaw is a kernel‑level resource management issue that can affect any system running the affected driver version.

The issue is present in the ALSA caiaq driver of the Linux kernel. No specific kernel version range is listed, so all kernel releases that include this driver are potentially affected unless later superseded by a patch.

The CVSS score is 5.5, and the EPSS score is unavailable, but the flaw has not been listed in the CISA KEV catalog. Based on the description, it is inferred that the vulnerability requires local access to the ALSA caiaq driver and a scenario that triggers the setup_card() error path, suggesting a moderate exploitation likelihood. An attacker with the ability to cause the error could exhaust kernel memory or destabilise the system. Remote exploitation without privileged access is unlikely based on the available description.