The vulnerability is a null pointer dereference in the pcm512x audio codec driver caused by treating a mixer kcontrol as a DAPM kcontrol. When pcm512x_overclock_xxx_put is invoked, the driver incorrectly accesses a null context, leading to a kernel fault. This fault can crash the system, resulting in a denial of service, but it does not provide a path for arbitrary code execution.

The flaw resides in the Linux kernel’s Advanced Linux Sound Architecture (ASoC) component. Any distribution or kernel build that includes the unpatched pcm512x driver is potentially vulnerable. Because the vendor list lists Linux:Linux twice, the issue applies to all Linux kernel versions that ship the non‑patched pcm512x driver and do not yet incorporate the fix, though no specific kernel versions are enumerated in the advisory.

The CVSS score of 5.5 reflects a moderate severity, and the EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Exploitation would occur when a user triggers the overclock control path in the audio subsystem; no evidence suggests remote exploitation or privilege escalation. The detected fault is confined to the kernel audio driver and would require local access to the affected hardware to trigger a crash.