The vulnerability arises because the stream_config structure passed to sdw_stream_add_slave() is not initialized, causing its type field to contain arbitrary data. When this data is later copied into stream->type by sdw_config_stream(), the driver may configure an invalid stream type, potentially disabling or misrouting audio output. This indicates an uninitialized variable flaw (CWE-908) that results in configuration errors rather than direct exploitation.

All Linux kernel builds that include the rt712‑sdca‑dmic codec driver are affected. Any system that compiles and loads this driver, regardless of the specific kernel release, could experience the issue.

The CVSS score of 5.5 reflects a moderate impact limited to audio configuration. The EPSS score of less than 1% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves loading or recompiling the driver, which requires kernel‑level privileges. No remote or code execution vector is documented, so the overall risk remains modest.