The issue arises in the ALSA USB audio driver where the function that parses MIDI streaming endpoint descriptors does not fully verify that the reported length of a descriptor fits within the remaining data. This oversight can allow a descriptor whose bLength field exceeds the bytes actually present, causing flexible‑array reads bounded by bLength but not by the remaining bytes in the endpoint‑extra scan. The result is an out‑of‑bounds read of kernel memory, which can leak sensitive information. The weakness corresponds to CWE‑125: Out‑of‑Bounds Read.

All Linux kernel installations that include the ALSA USB audio driver are vulnerable. Detailed version information was not provided. The vulnerability is resolved in the kernel tree after commit 09141583bd97f4bbd7358e29fd138fe798467cdb and related subsequent updates.

The vulnerability allows only reading of kernel memory, so it presents an information‑disclosure risk rather than a direct privilege escalation. Based on the description, it is inferred that the attack vector involves a malicious USB audio device that sends a crafted descriptor to a host with the vulnerable driver; thus the exposed pathway is local device interaction. The CVSS score is 5.5 and the EPSS score is less than 1%, indicating moderate severity but a low likelihood of exploitation. The entry is not listed in the CISA KEV catalog. While the exploitation probability in the wild is low, the potential to expose confidential data warrants timely remediation.