The vulnerability resides in the Linux kernel’s ALSA driver for the Focusrite Scarlett 2 USB audio interface. It stems from the driver incorrectly reusing a URB (USB Request Block) allocated for the notification endpoint, causing an uninitialized command completion variable. When the device initialization sequence proceeds, the kernel attempts to wait on a zeroed completion structure, which can lead to a crash and a system-wide kernel panic. This results in a denial of service whereby the affected system becomes unresponsive.

All Linux kernel installations that include the ALSA scarlett2 driver, notably those that use a Focusrite Scarlett 2 USB audio interface or have the faulty driver enabled. No specific kernel version numbers are supplied in the advisory, but the flaw was addressed in commits referenced in the provided kernel URLs.

No EPSS score is available, indicating insufficient data on exploit prevalence. The vulnerability is not listed in CISA’s KEV catalog. The flaw is an internal kernel error that requires interaction with the hardware to trigger, suggesting that exploitation likely needs physical access or a compromised local session. The impact is a critical kernel crash, but the probability of widespread exploitation remains uncertain due to the lack of publicly known exploit mechanisms.