The kernel flaw allows uninitialized heap memory to be copied into a user‑accessible buffer when a USB device sends a short transfer. Because the interrupt handler for the usbusx2y ALSA driver does not validate the actual transfer length, the copied data may contain arbitrary kernel memory contents, revealing sensitive information to a local attacker.

The vulnerability is present in the Linux kernel's usbusx2y ALSA driver. Specific affected kernel versions are not enumerated in the advisory, so any kernel containing the unpatched usbusx2y implementation could be vulnerable.

The defect does not enable arbitrary code execution; it only leaks kernel data. The EPSS score is not available and the flaw is not listed in the CISA KEV catalog, suggesting limited exploitation evidence. The likely attack vector requires a physical or otherwise trusted USB device capable of sending malformed short transfers, which limits the risk primarily to environments that accept untrusted USB hardware.