The defect in the Linux kernel allows a potential out‑of‑bounds array access within the ASoC rsnd component. The array element component_dais[RSND_MAX_COMPONENT] is incorrectly assumed to remain zero after initialization, which can lead to memory corruption when the index is later accessed. This weakness aligns with CWE‑787 and could compromise the integrity of kernel memory if exploited, potentially enabling arbitrary code execution under privileged.

All Linux kernel installations are affected because the defect is in the core Linux kernel source tree. No specific version ranges are listed; however, any kernel build containing the rsnd driver before the applied patch is vulnerable.

The CVSS score of 5.5 indicates a moderate severity, and the EPSS of less than 1% shows a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that exploitation would require local access to trigger the rsnd driver and provoke the out‑of‑bounds condition, so the likely attack vector is local, typically involving privileged escalation. Given the moderate score, the impact is limited to memory corruption rather than a guaranteed remote takeover.