A flaw in the Linux ALSA usx2y driver allows a process that can open the hardware device driver (hwdep) node to calculate a kernel address from an arbitrary page offset without bounds checking. The fault handler translates the offset into a kernel virtual address and returns a page struct that can be mapped read‑write into user space. An offset outside the single allocated shared page results in a read of kernel memory that the process does not own, and writing to that memory can corrupt kernel objects. This enables a local attacker to read and modify arbitrary kernel memory, effectively providing kernel‑level code execution.

All current Linux kernel releases that include the snd_usb_usx2y module (e.g., versions 5.x, 6.x, and 7.x for arm64) and any system connected to a US‑X2Y audio device. The bug is triggered when an application loads an FPGA image through the same device, so any user or process with access to the device node is potentially affected. Systems using the ALSA hwdep interface for US‑X2Y hardware are at risk.

The flaw is a local privilege escalation vector; any process that can access the device node can exploit it. No external network attack surface is required. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the CVSS score is not provided. Given the ability to read/write arbitrary kernel memory, the risk is high and the potential impact is full kernel compromise. The attack requires no special capabilities beyond standard user permission on the hwdep node, so it can be exercised by any unprivileged user that has upload rights for the FPGA image. The lack of bounds checking and permission validation is the core weakness.