The vulnerability stems from the ALSA usb‑audio driver incorrectly handling the fill_max descriptor flag. When a USB audio endpoint requests full packet transfers, the driver promotes the current packet size but fails to update the maximum packet size used to calculate the DMA buffer. The resulting buffer is significantly smaller than the data transferred, allowing a USB host controller to write beyond the buffer end and corrupt kernel heap memory. This overflow can lead to arbitrary memory corruption, which could be leveraged by an attacker to gain elevated privileges or crash the system.

Affected systems: All Linux kernel versions that include the affected ALSA usb‑audio driver without the patch. The specific vulnerable kernel versions are not listed in the provided data, but any kernel that has not applied the fix is susceptible.

The vulnerability is a local kernel memory corruption. The EPSS score is <1% and the flaw is not listed in the CISA KEV catalog, indicating a low exploitation probability. The CVSS score of 7.0 indicates medium to high severity. The likely attack vector is through a malicious USB audio device: based on the description, it is inferred that an attacker could trigger the overflow by connecting a specially crafted USB audio device and forcing the host controller to stream data at the larger packet size. This could allow the attacker to corrupt kernel heap memory, potentially leading to privilege escalation or a denial of service. Administrators should still prioritize applying the kernel patch.