The vulnerability stems from the ALSA es1938 driver in the Linux kernel, where the function snd_ctl_new1() can return a NULL pointer if memory allocation fails. The driver fails to check this return value before dereferencing it, which can cause a NULL pointer dereference. This results in a kernel panic and system crash, effectively denying service. The defect represents a classic null pointer dereference and, while local in nature, could allow a malicious user to forcibly destabilize the kernel during a crash.

All Linux kernel builds that include the es1938 audio driver without the patch fixing this oversight are vulnerable. No specific kernel versions are listed, so the issue applies to all affected distributions until the kernel source incorporates the correct NULL check. The vulnerability impacts the Linux kernel as a whole, particularly systems using hardware supported by the es1938 driver and the ALSA subsystem.

The CVSS score is not provided, but the type of failure suggests a severe impact in that a kernel crash yields a critical denial of service. The EPSS score of less than 1% indicates a very low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, further suggesting limited active exploitation. The likely attack vector is local: an attacker with the ability to interact with the ALSA es1938 driver can trigger the allocation failure and cause the crash. Despite the low likelihood, the high consequence warrants prompt mitigation.