During the disconnection of a USB audio device, the ALSA USX2Y driver cancels its capture and MIDI‑in work queues before the related USB transfer requests are terminated. If a transfer completes after cancellation but before termination, its completion handler reschedules the work queue. When the driver’s card structure is finally freed, the pending work is later executed on memory that has already been released, producing a use‑after‑free condition (CWE‑825). This flaw can cause the kernel to crash; based on the mechanics of the flaw, it could also allow execution of arbitrary code with kernel privileges, but such code execution is not directly mentioned in the advisory and is inferred as a possible consequence.

The vulnerability affects any Linux kernel installation that includes the ALSA USX2Y (tascam) driver before the patch commit referenced in the advisory. No specific kernel versions are listed, implying that all earlier releases that retain this driver are potentially impacted unless the driver has been removed or disabled.

The EPSS score is less than 1 % and the vulnerability is not listed in CISA KEV, indicating a low likelihood of exploitation in the wild. The CVSS score of 5.5 classifies it as a medium‑impact flaw. Based on the description, it is inferred that exploitation requires a local attacker with physical or USB access to a device that uses the USX2Y driver and the ability to trigger a disconnect, positioning it as a local privilege escalation or denial‑of‑service vulnerability.