The vulnerability resides in the ALSA USB audio driver, where the function that parses MIDI streaming endpoint descriptors does not fully verify that the descriptor length fits within the remaining data. This can allow a malicious USB audio device to send a descriptor whose reported length exceeds the actual bytes present, enabling flexible‑array reads that go beyond the bounds of the allocated buffer. The result is a kernel read of unintended memory, potentially leaking sensitive information. The weakness corresponds to CWE‑125: Out‑of‑Bounds Read.

All Linux kernel installations that include the ALSA USB audio driver are vulnerable. No specific kernel versions are listed; the vulnerability is resolved in the kernel tree after commit 09141583bd97f4bbd7358e29fd138fe798467cdb and related subsequent updates.

Because the flaw permits only reads of kernel memory, it is an information‑disclosure risk rather than a direct escalation path. The attack requires physical access to supply a crafted USB audio device, so the entry‑point is local but depends on device interaction. No CVSS score or EPSS data is available, and the vulnerability is not currently listed in the CISA KEV catalog. The likelihood of exploitation in the wild appears low, though the potential to expose confidential data warrants timely remediation.