The flaw resides in the ALSA subsystem of the Linux kernel. The in04_last array is declared larger than the source buffer in04_buf. During initialization the code copies 24 bytes from a 21‑byte buffer using memcpy, causing a read past the allocated memory. This out‑of‑bounds read can leak adjacent kernel memory, leading to information disclosure, or crash the kernel if the read touches unmapped memory. The flaw is a classic case of memory corruption as classified by CWE‑125.

All Linux kernels that contain the ALSA usbusx2y driver prior to the fix are affected. The vulnerability is present in the kernel’s ALSA subsystem for all distributions and versions that ship the unpatched code. Users should verify that their kernel image includes the USX2Y_IN04_SIZE guard introduced in the patch; kernels after the patch are not vulnerable.

The vulnerability is not listed in the CISA KEV catalog and no EPSS score is available, suggesting no widespread exploitation yet. However, the out‑of‑bounds read occurs in kernel space and can be triggered from userland via ALSA commands, meaning a local attacker with sufficient privileges or the ability to interact with the usbusx2y device can potentially exploit the bug. The absence of a known exploit lowers immediate threat, but the kernel memory corruption could serve as a foothold for privilege escalation or denial‑of‑service, so timely patching is recommended.