The ALSA usb‑audio driver in the Linux kernel contains a loop in convert_chmap_v3() that steps through data using the descriptor length field, cs_desc->wLength. Because the code does not verify that this field is within the bounds of the descriptor buffer, a crafted descriptor can cause the loop never to terminate. The result is an unbounded CPU‑bound operation that can starve other kernel work and may effectively freeze the system. The flaw is a classic case of unchecked input leading to an infinite loop, consistent with CWE‑606 and CWE‑835.

All Linux systems that load the snd‑usb‑audio module are potentially affected. The advisory does not specify a kernel version, so the issue may exist in any release prior to the commit that introduced the fix. Users of distributions that provide the upstream kernel should verify whether their current image includes the patch from commit 4e0ee232ebe3df04874125d7c7f3e6c25ea5483d.

Based on the description, it is inferred that the attacker needs to provide a malicious USB audio device that can be enumerated by the kernel. The likely attack vector is either physical connection of such a device or remote exploitation if USB passthrough is enabled. The vulnerability can cause an infinite loop, leading to a CPU‑bound denial of service; the EPSS score of < 1% indicates a very low likelihood of exploitation in the wild. The CVSS score of 5.5 places the vulnerability in the medium severity range, and the impact on availability is significant for uptime‑critical environments. The vulnerability is not currently listed in the CISA KEV catalog, meaning no known public exploitation has been reported.