The Linux ALSA usb-audio driver (caiaq) contains a routine that reads a reply from a USB endpoint and interprets the first byte as a command. Subsequent code accesses fixed offsets in the same buffer without guaranteeing that the response packet is long enough. This omission allows an attacker controlling the USB device to send a reply that is shorter than expected, causing an out‑of‑bounds read that corrupts kernel memory. The resulting corruption can trigger a kernel panic or similar instability. No evidence of code execution from this defect is provided in the advisory.

All Linux kernel releases that include the caiaq driver prior to the described patch are affected. This includes mainstream distributions that ship the default ALSA firmware. Specific kernel versions are not enumerated in the advisory, so any system running the vulnerable kernel configuration should be assumed at risk until the patch is applied.

The CVSS score of 5.5 indicates moderate severity. The EPSS score is < 1% and the vulnerability is not listed in CISA’s KEV catalog, indicating no publicly known exploits at this time. The defect remains an out-of-bounds read that could destabilize the kernel; however, no exploit demonstration or further impact beyond a crash is documented. The likely attack vector requires a malicious USB audio device that can send forged replies to the system’s ALSA controller. The risk level is therefore moderate, constrained by the need for physical or local USB access and the absence of confirmed exploit code.