The vulnerability arises from an out‑of‑bounds write in the ALSA FCP driver when reading a level meter control that is given a map larger than the kernel’s internal buffer can handle. The driver accepts a map size up to 255, but the kernel allocation for the control’s value array is limited to 128 entries, and the driver writes past the array without enforcing that bound. This unchecked memory corruption can overwrite adjacent kernel data, enabling an attacker to corrupt kernel memory and potentially gain higher privileges or crash the system. The weakness is a classic out‑of‑bounds write, giving attackers direct control over sensitive memory locations.

All Linux kernel versions that include the ALSA FCP driver and have not applied the patch found in commit 620f1e52a46f6. The issue is present in kernel releases before the fix and applies to any distribution that ships the affected kernel without the update.

The vulnerability is considered severe due to the potential of kernel memory corruption. The EPSS score is not available, so the current probability of exploitation is unknown, but the flaw can be triggered by a user with CAP_SYS_RAWIO and, because the control survives past the creation of the device descriptor, a local attacker can repeatedly read the control to trigger the out‑of‑bounds writes. The flaw is not listed in CISA’s KEV catalog, yet the potential for kernel memory corruption means it could be weaponized for local privilege escalation or denial of service. If an unprivileged user can read the control, the attack surface is large, making exploitation of this flaw feasible for a local adversary.