The ALSA usb‑audio driver limits the enumeration of sample rates to a maximum number of triplets, but when a USB audio device supplies a malformed UAC2 RANGE response that contains more triplets than the limit, the driver continues parsing the remaining entries, repeatedly logging an "invalid uac2 rates" error while holding a global mutex during device probe. The excessive log output and prolonged mutex hold can degrade system responsiveness or trigger a denial of service if a malicious device repeatedly sends oversized responses. This flaw reflects the CWE‑606 weakness: unchecked input validation leading to resource exhaustion.

All systems running a Linux kernel that includes the ALSA usb‑audio driver and has not incorporated the patch that stops parsing beyond MAX_NR_RATES are affected. Distribution kernels that predate the commit remain at risk; any system built from a source tree older than the fix is susceptible.

The CVSS base score of 5.5 indicates moderate severity due to the resource‑exhaustion nature of the flaw. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attack vector requires an attacker to connect a malicious USB audio device to the target system, either physically or via a compromised peripheral interface. The flaw does not require privilege escalation or code execution on the host to be exploited, but does rely on the target’s kernel driver accepting and parsing the malformed response.