The virtio sound driver in the Linux kernel accepts control metadata supplied by a virtio device without validating the control type or value count. This untrusted data is subsequently used to index an internal mapping array and to size memory copy operations. When a buggy or malicious device advertises an invalid control type or an oversized value count, the driver performs out‑of‑bounds memory accesses. Such corruption can lead to kernel crashes, data leakage, or unintended behavior, but the information does not explicitly state that it results in remote code execution.

All Linux distributions that use the Linux kernel’s virtio‑snd implementation are affected, up to the kernel release that introduced the control‑metadata validation commit. The vulnerability is present in the generic Linux kernel and therefore applies to virtually every Linux system that loads the virtio‑snd driver.

The CVSS score of 8.4 indicates high severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation at the moment. The vulnerability is not listed in CISA’s KEV catalog, implying no publicly documented exploits. An attacker would need to provide a malicious virtio sound device or compromise a hypervisor that can supply such a device. The risk is therefore moderate to high for environments where untrusted virtualization guests or devices are allowed to attach to the host.