In the Linux kernel, the ALSA usbusx2y driver processes interrupt URBs without verifying the actual transfer length. When a malfunctioning or malicious USB device sends a transfer shorter than expected, the driver reads uninitialized data from a heap buffer allocated with kmalloc. This data is then copied into the ctl_snapshot[] array, which is exposed to user space via memory mapping, resulting in leakage of kernel heap contents.

All Linux kernel versions that have not incorporated the pre‑patch commit 2770321b358658e0a39fe39ccf6a91ee97a81931 (and any subsequent releases that do not apply the changes) are vulnerable. The weakness resides exclusively in the ALSA usbusx2y driver; any distribution shipping an unpatched kernel with this driver enabled is susceptible regardless of other kernel modules or user‑space components.

The CVSS base score of 5.5 indicates moderate severity, and an EPSS score of less than 1 % along with the absence from the CISA KEV catalog suggest a low likelihood of broad exploitation soon. Attackers would need local or physical access to connect a crafted USB device and would also need the ability to map the ctl_snapshot array into their process address space to read the leaked data. There is no demonstrated capability for remote code execution or privilege escalation from this vulnerability.