An ALSA component in the Linux kernel creates a control object without verifying that the allocation succeeded. When memory allocation fails, the kernel dereferences a NULL pointer, causing an unexpected crash. The failure does not compromise confidentiality or integrity, but it can repeatedly terminate the audio subsystem or the entire machine, leading to a denial of service if the fault can be triggered repeatedly.

The vulnerability is present in the Linux kernel’s ALSA gus driver. All kernel releases that include the original code path are potentially affected, including backported versions that have not yet integrated the check performed in the fix. No specific product or version list is provided, so the safe assumption is that all current Linux kernels lacking the patch are vulnerable.

The CVSS score is 5.5, indicating moderate severity. The EPSS score is < 1%, showing a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, further indicating limited exploitation. Attackers would need to exercise ALSA control operations that trigger the allocation, which is typically a local or privileged activity; no remote exploitation vector is described. The risk to availability is high if the fault can be triggered repeatedly, though the overall likelihood of successful exploitation remains low.