The Linux kernel contains a flaw in the USB audio driver where a missing sanity check of the bNrChannels field allows a division by zero in playback_urb_complete() and capture_urb_complete(). If an attacker supplies a USB audio device that advertises bNrChannels as zero, the kernel will attempt to divide by the resulting zero frame_bytes value and crash. The crash manifests as a kernel panic, leading to a system reboot and a brief but complete loss of service.

All Linux kernel distributions are affected, as the vulnerability resides in the common sound subsystem code. The exact kernel versions are not enumerated in the advisory, but the patch referenced in the source material applies to recent mainstream kernels. Users running older kernels that lack this fix are also vulnerable until updated.

The flaw is a classic division-by-zero error stemming from insufficient input validation. An attacker can trigger it by presenting a malicious USB audio device; network-based exploitation is unlikely, so the attack surface resembles physical or local device access. Although the CVSS score is not reported and the EPSS score is unavailable, kernel crashes have high impact on availability. The vulnerability is not listed in CISA's KEV catalog, suggesting no public exploits yet, but the simplicity of the trigger means it could be weaponized quickly.