The ASoC Intel AVS subsystem previously accessed entries in the init_configs array using indices derived from the config_ids array. When an ID equal to or larger than num_init_configs was used, the code performed an out‑of‑bounds read, potentially allowing memory corruption within the kernel. This flaw is a classic array bounds violation that may enable an attacker to read or overwrite sensitive kernel data, thus creating a vector for privilege escalation or service disruption.

Any Linux kernel installation that includes the ASoC Intel AVS drivers and has not yet applied the patches referenced by the three kernel commits cited in the advisory. No specific kernel release numbers are listed, but the fix addresses the flaw in all affected builds before the commit snapshots provided.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no widely known public exploitation yet. However, out‑of‑bounds kernel access is a high‑severity class of defect, and an attacker who can supply crafted config IDs—either locally or through a privilege escalation path—could potentially exploit the flaw to execute arbitrary code at kernel level or to crash the system. The lack of a public exploit does not mitigate the inherent risk posed by the underlying memory corruption.