The flaw lies in two callback functions of the fsl_audmix ALSA sound driver. They convert a user‑supplied enum value before verifying that it is within the valid range of the enumeration. This can lead an out‑of‑range value to be used in a bit test or array indexing, which may corrupt kernel memory or cause a crash. Based on the description, it is inferred that such corruption could potentially lead to privilege escalation, although the vulnerability description does not explicitly state this.

All Linux kernel builds that include the fsl_audmix driver, which is part of the ALSA System on Chip (ASoC) subsystem. The vulnerability remains present in any kernel version that has not yet incorporated the patch present in the Git log commits referenced in the advisory. Users who have the fsl_audmix module loaded and have access to configure audio settings are at risk. The affected system scope is inferred from the description.

The CVSS score of 7.8 indicates high severity, while the EPSS score of less than 1% suggests that exploitation is not currently common. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector would require a local user capable of interacting with the audio subsystem to supply an out‑of‑range enum value. If successful, the resultant kernel memory corruption could trigger a crash or potentially provide a foothold for privilege escalation, as inferred from the potential for memory corruption.