The vulnerability is in the Linux kernel's virtio sound driver, where control metadata supplied by the device is not validated before being used. Trusted metadata such as control type and value count are directly used to index arrays and to size memory copies. A malicious or buggy virtual device can supply an invalid type or an oversize count, causing out‑of‑bounds array accesses and potentially corrupting memory. This flaw can lead to arbitrary code execution or a denial of service if the attacker gains sufficient privilege to influence the virtio device.

This flaw affects the Linux kernel wherever the virtio sound driver is enabled. All kernel versions prior to the patch commit mentioned in the advisory are affected. No specific version numbers are listed, thus any kernel build that includes the older virtio‑snd implementation and has the driver loaded is vulnerable.

EPSS indicates a less than 1% probability of exploitation at the time of analysis, and the CVSS score of 8.4 indicates high severity; the vulnerability is not listed in CISA KEV, meaning no publicly documented exploits have yet been found. However, the potential for memory corruption gives the flaw high impact. The likely attack vector is a malicious or compromised virtual device; based on the description, it is inferred that an attacker would need to provide a malicious virtio device or compromise the virtualization environment that supplies the device, so exploitation is likely confined to systems running in virtualized contexts where trusted device drivers can be influenced. Accordingly, the risk is moderate to high for such environments.