The Linux kernel’s ALSA usb‑audio subsystem fails to clamp the calculated frame size for sync packets in implicit‑feedback mode. When a USB audio device sends a packet larger than the endpoint’s maximum frame size, the codec records an inflated frame count that is later used by the playback queue. This can cause packet transfers to exceed hardware limits, potentially leading to kernel instability, crashes or a denial‑of‑service state for the audio subsystem.

All Linux kernel builds that include the ALSA usb-audio driver and support implicit‑feedback mode are affected. No specific release string is provided, but any kernel compiled with the default usb‑audio configuration that has not applied the patch is vulnerable.

The CVSS score of 8.4 indicates high severity. The EPSS score is < 1%, suggesting a very low but non‑zero likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Because the flaw is triggered by a malicious USB audio device, the attack vector requires an attacker to have physical or logical access to the USB port. An attacker could connect a crafted device to a target machine, send oversized sync packets and induce a crash or degrade audio service. No remote code execution path is indicated in the official description; the primary consequence is a local denial‑of‑service through kernel instability caused by an overflowed packet count.