The ALSA usb‑audio driver for Qualcomm devices sets a flag indicating that a substream is opened before it checks the validity of the requested service interval. When an invalid interval is supplied, the enable operation fails but the flag is not cleared; the substream remains marked as busy until a disable or device disconnect occurs, preventing subsequent attempts to use the stream and resulting in repeated failures that can be exploited to deny audio service to users.

All Linux kernel installations that include the unpatched version of the ALSA usb‑audio Qualcomm driver are affected. The critical code path is present in every kernel build that ships this driver without the upstream patch; therefore any distribution with a kernel that predates the fix may be vulnerable.

The CVSS score is 5.5 and the EPSS score is reported as less than 1%, indicating a very low exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attack vector is local. Exploitation requires a local process capable of interacting with the usb‑audio driver (e.g., a user or a privileged service) to submit an invalid service interval, which would then leave the substream in a stuck state and cause denial of the audio function.