The flaw is a double‑free in the ALSA caiaq driver’s cleanup logic. When an error path is triggered, the driver attempts to release audio objects such as URBs that may have already been freed, corrupting the kernel heap. A kernel crash or panic can result, which effectively brings the system down until a reboot or manual intervention.

The affected component is the ALSA caiaq driver in the Linux kernel. Any kernel that includes the unpatched caiaq driver code before the committed fixes may be impacted. No specific version ranges are listed, so the vulnerability applies to kernels containing the vulnerable source.

The CVE data lists a CVSS score of 7.0, indicating moderate to high severity. The EPSS score of less than 1% suggests a low likelihood of immediate exploitation, and the vulnerability is not listed in the CISA KEV catalog, which implies no known exploitation campaigns. The attack vector is not described, but the issue arises during the driver’s error handling path. Exploitation could lead to a denial of service through a kernel crash, but no other impacts are documented in the official description.