The ALSA cmipci driver in the Linux kernel can dereference a NULL pointer because the function snd_ctl_new1() may return NULL when a memory allocation fails; the subsequent code in snd_cmipci_spdif_controls() does not verify this return value before accessing kctl->id.device, which causes a kernel panic and a system reboot. This manifests as a denial‑of‑service that affects only the host experiencing the crash.

Any system running a Linux kernel with the ALSA cmipci driver that has not yet incorporated the NULL‑check fix is vulnerable. The fix was applied to the kernel source in the commits referenced above, and all patches that include this change protect against the vulnerability. Consequently, all kernel releases prior to those commits are considered at risk, regardless of distribution; this includes standard kernels shipped by most vendors under the default ALSA configuration.

The CVSS score of 5.5 reflects a moderate severity. The EPSS score of less than 1 percent indicates a very low probability that an attacker will successfully exploit this flaw. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. Based on the description, the likely attack vector is local or requires elevated privileges to induce a memory allocation failure that triggers the NULL pointer dereference; an attacker would need to provoke such a failure, which is unlikely in normal operation.