The Linux kernel ALSA USB‑audio driver for Qualcomm devices contains a defect in the handle_uaudio_stream_req routine that performs an unchecked negative index lookup when a stream disable request is processed without a resolved interface. The code path fails to guard against a -EINVAL value, dereferencing a pointer that may be NULL or pointing before an allocated slab. This results in an out‑of‑bounds read and a transient out‑of‑bounds write that can corrupt kernel memory and trigger a kernel oops.

All Linux kernel builds that include the Qualcomm audio driver component are impacted. The bug resides in the audio subsystem configuration that loads the qcom ALSA USB‑audio module, so any kernel host that boots this module and has not received the upstream fix is vulnerable.

The flaw is reachable from local, unprivileged userspace through the AF_QIPCRTR communication channel. An attacker can trigger the corruption by sending a crafted disable request with an interface number that does not resolve to an active interface. The EPSS score is less than 1 %, and the CVSS score is 7.8, indicating a high severity vulnerability. The impact is limited to the local host and does not require elevated privileges, but the uncontrolled memory corruption can cause system instability and could be leveraged to gain further compromise if additional kernel weaknesses are present. The vulnerability is not listed in the CISA KEV catalog.