The bug originates in the Linux kernel’s ALSA dummy driver, where the probe routine blindly trusts the device index supplied via a sysfs interface. If an attacker supplies a value of -1, the driver will perform an out-of-bounds read on internal arrays, which can corrupt kernel memory or cause the kernel to crash. The vulnerability does not immediately provide remote code execution but can be leveraged to disrupt system stability or to create a foothold for further exploitation through memory corruption.

This issue affects all kernel builds that include the ALSA dummy driver, as identified by the generic Linux kernel CPE. No specific vendor or version constraints are listed, meaning the problem is present in any kernel that has not applied the fix for the dummy driver’s card index validation.

The CVSS score for this flaw is not provided in the input, and the EPSS metric is unavailable, indicating no current public exploitation data. The flaw is listed as not included in the CISA KEV catalog. Because the defect requires manual manipulation of the sysfs interface, it is likely to be a local or privileged attacker scenario rather than a global remote attack vector.