In the Linux kernel, the Conexant HDA driver ignores the return value from snd_hda_jack_detect_enable_callback() during initialization. When that call fails and returns an error pointer, the driver proceeds with an uninitialized jack‑detection callback. A later attempt to handle jack events dereferences this invalid pointer, causing a kernel crash. The weakness is a failure to verify error return values, which falls under the CWE-390 "Missing Error Checking for Output of Initializing Calls".

All Linux kernel implementations that include the Conexant HDA driver and have not yet merged the patch that introduces the error check. This includes every distribution based on the generic Linux kernel that compiled the hda_conexant module before the commit referenced in the advisory.

The CVSS score of 5.5 indicates medium severity, while the EPSS score of less than 1% suggests that successful exploitation is very unlikely. The vulnerability is not directly reachable from user space; it would require the driver to be loaded during hardware initialization, potentially triggered by a reset or power cycle of the audio hardware. No known public exploits exist and the vulnerability is not listed in the CISA KEV catalog, so the risk to unpatched systems remains primarily theoretical but significant due to the impact of a kernel crash.