The vulnerability resides in the ALSA es18xx audio‑codec driver used by Linux kernels. When the mixer is initialized, the driver calls snd_ctl_new1() to allocate control structures and then stores bookkeeping pointers before adding the control with snd_ctl_add(). If the allocation fails, snd_ctl_new1() returns NULL, yet the driver continues to dereference the returned pointer. This NULL pointer dereference causes a kernel crash, leading to a denial of service at the system level. The flaw is a classic NULL pointer dereference (CWE‑476).

All Linux kernel builds that incorporate the ALSA es18xx driver and compile the unpatched initialization code are potentially affected. No specific version ranges are cited; any kernel containing the described code path could be compromised.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of <1% reflects a very low current exploitation probability. The vulnerability is not listed in CISA KEV. The likely attack vector is local; an attacker would need privileged access to load or interact with the es18xx driver during boot or module insertion to trigger the allocation failure path. Consequently, the risk manifests as a local denial of service through a kernel crash, with impact confined to the affected host.