A malformed USB device can advertise a vendor‑specific interface without any endpoint descriptors. The ALSA FCP subsystem in the Linux kernel parses the device, selects the first vendor‑specific interface and then attempts to read endpoint 0. Because the interface declares zero endpoints, no endpoint array is allocated and the call to usb_endpoint_num() dereferences a NULL pointer, causing a kernel oops that crashes the system. The weakness is a classic NULL pointer dereference (CWE‑476).

All Linux kernel versions that contain the ALSA FCP driver prior to the fix commit 3ab06151ffcb8c3aeb8f78508658b6c0f05be932. The vulnerability affects the Linux Kernel as a whole, regardless of distribution, for any kernel that has not yet been updated to the patched version.

The flaw results in a clear denial‑of‑service and would be exploitable on any host that processes a malicious USB device. The CVSS score of 5.5 indicates a moderate severity impact to availability. The EPSS score is < 1% and the vulnerability is not listed in CISA’s KEV catalog, indicating that no widespread public exploits are currently known. However, the attack can be performed with physical or firmware‑level access to a USB port, making it highly feasible in environments that allow arbitrary USB devices to be attached.