The bug existed in the function that adds element groups to the soundwire driver, where a loop erroneously iterated one time too many, allowing an array index to exceed the bounds of the group->rates and group->lanes arrays. This out‑of‑bounds memory access could corrupt kernel memory, potentially leading to kernel crashes, information disclosure, or local privilege escalation, depending on the attacker’s context.

All Linux kernels containing the soundwire driver that have not yet incorporated the commit that fixes the off‑by‑one loop are at risk. The patch is part of the mainline kernel and is present in any kernel release built after the referenced commit. Kernels built before the fix remain vulnerable.

Based on the nature of kernel memory‑corruption flaws, it is inferred that the vulnerability could be triggered by a local attacker who can interact with the soundwire driver (for example, by loading the module, sending control commands, or manipulating device parameters). The CVSS score is 7.8. The EPSS score is listed as less than 1 % and the vulnerability is not included in CISA’s KEV catalog, indicating a low publicly known exploitation probability at present. Nevertheless, kernel memory‑corruption bugs have historically posed high exploitation risk if not patched. The correct mitigations are to update the kernel or otherwise prevent exploitation of the affected driver.