In the Linux kernel sound subsystem, a TOCTOU race causes the ioctl handler sof_ipc4_bytes_put() to copy buffer data using a stale size field from existing kernel data instead of the size supplied by user space. Because the copy length can be incorrect, the kernel may write beyond the intended bounds, truncating valid data or copying stale bytes. This flaw can corrupt kernel memory, disabling audio services or potentially causing a system crash.

All Linux kernel releases that expose the ASoC synchronous firmware IPC4 control interface before the documented commit that validates the incoming size field are affected. Kernel versions that do not yet include the patch and still contain the old implementation are therefore vulnerable.

The CVSS score of 7.8 indicates a high severity, while the EPSS score of <1% suggests exploitation is currently rare. The likely attack vector is local, requiring a user-space process to send IPC4 control messages. If an attacker can repeatedly trigger the race, they could corrupt kernel data, gain a denial of service, or potentially execute arbitrary code if a subsequent vulnerability is triggered. No known public exploit exists, and the vulnerability is not listed in CISA KEV.