The ALSA ymfpci driver contains a flaw where the function snd_ctl_new1() can return NULL when the kernel fails to allocate memory. The caller, snd_ymfpci_create_spdif_controls(), dereferences the returned structure without checking for NULL, accessing kctl->id.device. If this occurs, the kernel will dereference a NULL pointer, leading to a crash. The vulnerability is identified as a null pointer dereference (CWE‑476) and results in a loss of availability for any process running on the affected system.

Any Linux kernel that includes the ALSA ymfpci driver in its modules and has not yet integrated the recent patch is susceptible. The vendor listings indicate Linux kernel source, and there are no specific version bounds provided, so all builds containing the unpatched ymfpci code are potentially at risk until the kernel is updated.

The CVSS score of 5.5 categorizes the issue as medium severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker would need local access to load or reinitialize the ALSA ymfpci driver, making the likely attack vector local. No active exploits are documented; a successful exploitation would force a kernel panic, causing a system reboot or denial of service for legitimate users.