The Linux kernel’s ALSA USB‑audio driver for Qualcomm devices dereferences a negative index when processing a stream disable request. The code path fails to guard against a -EINVAL interface index, causing an out‑of‑bounds read and, when the target pipe fields are non‑zero, a transient out‑of‑bounds write. This results in memory corruption and a kernel oops, which can be leveraged by an attacker to gain elevated privileges on the system.

All Linux kernel builds that include the qcom ALSA USB‑audio driver are affected. The vulnerability exists in any kernel that has not been patched to address the unchecked index handling in handle_uaudio_stream_req().

The flaw is reachable from local, unprivileged userspace via the AF_QIPCRTR socket interface. An attacker can trigger the corruption by sending a crafted disable request with an unmatched interface number. While the CVE has no published EPSS value and is not listed in the CISA KEV catalog, the nature of the bug—unbounded memory access that can lead to kernel takeover—indicates a high severity if exploited. The attack vector requires local access but only requires user privileges and therefore poses a significant risk to environments where the qcom audio driver is loaded.