The vulnerability resides in the ALSA PCM subsystem of the Linux kernel. When snd_pcm_drain() is called on a linked stream, the routine incorrectly adds a wait‑queue entry that is not properly initialized. If the stream is concurrently unlinked, the orphaned wait entry remains attached to the old sleep queue. Subsequent drain operations add the same entry to a new queue while it is still on the old one, corrupting both linked lists. When the kernel later attempts to wake and dereference the mis‑linked entry, it accesses a NULL function pointer, causing a kernel panic. This leads to a denial‑of‑service condition that can bring the entire system down.

All Linux kernel releases before the patch are affected. The flaw appears in the ALSA component of the generic Linux kernel and is independent of distribution. The kernel source shows the commit replacing init_waitqueue_entry/add_wait_queue with init_wait_entry/prepare_to_wait/finish_wait; the fix is included in mainline from an unspecified commit date. Therefore any Linux system running a kernel version earlier than the merged commit is vulnerable.

The precise CVSS score is not listed, but a kernel panic is a severe outcome. Exploitation likely requires local access to trigger snd_pcm_drain() on a linked stream while it is concurrently unlinked, by an untrusted audio application. Because the vulnerability is triggered by normal audio operations, an attacker with local permissions could potentially cause the crash. The EPSS score is unavailable, and the vulnerability is not in the CISA KEV catalog, so no active exploit is publicly known. Nevertheless, the high impact warrants urgent patching, especially in environments that expose the ALSA subsystem to untrusted users or remote code.