In the ALSA usb‑audio driver for the Linux kernel, the function that reads the status of an RME Digiface device copies data from an on‑stack buffer that has not been initialized. If a control‑IN transaction returns fewer bytes than requested, the remaining words of that buffer still contain leftover stack data, which is then passed to user space through the normal ALSA control interface. This results in an unprivileged user able to read sensitive kernel memory, exposing confidential information. The weakness is a use of uninitialized data that leads to information disclosure, corresponding to CWE‑908.

All Linux kernel builds using the ALSA usb‑audio driver prior to the patch that zero‑initializes the status buffer are affected. The issue is located in the audio subsystem, specifically the RME Digiface status handling code. No specific kernel versions are listed, so any kernel containing the old implementation of snd_rme_digiface_read_status is vulnerable.

The vulnerability is exploitable by any local user who can access the /dev/snd/controlC* devices and issue the appropriate control request. An attacker does not need elevated privileges; the attacker simply uses the existing ALSA interface to trigger a short control‑IN response and then reads the returned status values, which will include leaked stack data. The EPSS score is <1%, and the vulnerability is not listed in the CISA KEV catalog, indicating that widespread exploitation has not been observed yet. However, the impact is significant for confidentiality because information about kernel state can be exposed to unprivileged users. The CVSS score of 5.5 reflects moderate risk.