During the initialization of an ALSA caiaq audio card in the Linux kernel, a reference counter leak occurs when usb_get_dev is called but usb_put_dev is never executed due to a missing assignment of the private_free destructor on failure paths. This results in an unbalanced reference count on the struct usb_device, causing leaked kernel memory that includes device descriptors and private data. The leak can be triggered by a non-compliant USB device, potentially leading to exhaustion of kernel memory and degraded system stability. No direct remote code execution or privilege escalation is achieved, but repeated exploitation could lead to a denial of service.

All Linux kernel installations that include the legacy ALSA caiaq driver compiled into the kernel are affected. Affected users are those running operating systems where the ALSA caiaq driver remains enabled, regardless of specific kernel release; the vulnerability exists before the patch that moved the private_free assignment into create_card().

The flaw can be triggered by an attacker who has the ability to connect a crafted USB device to the target machine, as the kernel performs usb_set_interface on device initialization. Because the exploit requires a hardware USB device and the kernel must be running the caiaq driver, the attack vector is classified as local or semi-physical rather than remote over the network. The EPSS score is not available and the CVE is not listed in the CISA KEV catalog, suggesting that no public exploit has been observed. Nonetheless, repeated failures during card initialization could lead to memory exhaustion, providing a potential denial‑of‑service path that may degrade or crash the host. The severity, though not quantified with a CVSS score, is therefore considered moderate, and the risk can be mitigated by applying the kernel update that addresses the reference count leak.