The vulnerability originates in the ALSA PCM subsystem of the Linux kernel, where the code that sets up an I/O buffer iterator for data transfer incorrectly applies the same logic when silencing an audio stream (i.e., when the data pointer is NULL). This misconfiguration can produce a bogus iterator, which on RISC‑V hardware leads to a null pointer dereference. The resulting fault causes an OOPS or kernel panic, leading to a denial of service and potential loss of system availability. The weakness is a classic null pointer dereference, classified under CWE‑476. Based on the description, it is inferred that triggering this flaw requires access to the ALSA silencing path, implying a local or privilege‑level attack vector.

All builds of the Linux kernel running on RISC‑V architecture are potentially affected, until the patch that correctly handles the NULL data case in interleaved_copy() is applied. No specific kernel version range is quoted in the CVE data; administrators should consult the vendor’s update stream for the relevant fix.

The CVSS score of 7.8 indicates a high severity, while the EPSS score of less than 1 % signals a low likelihood of active exploitation at the time of this assessment. The vulnerability is not listed KEV catalog, so no confirmed widespread attacks impact is local to the host; an attacker would need to trigger the ALSA silencing path, which typically requires local access or a vulnerability that enables interaction with audio drivers. Based on the description, it is inferred that the attack vector is local since engaging the ALSA silencing path requires user or privileged interaction. The combination of high severity and low exploit probability places the overall risk in the moderate category, warranting prompt remediation.