The Linux kernel ALSA virtio sound driver deletes its virtqueues before resetting the device, freeing vring backing memory while the device still references it. This leads to a use‑after‑free condition that can corrupt kernel memory or trigger a crash, effectively causing denial of service. The flaw is a classic case of a memory‑management defect coupled with improper deallocation (CWE-825).

All Linux kernels that include the virtio‑pci ALSA sound subsystem and have not yet incorporated the committing patch are affected. This includes both virtualization hosts and guests using virtio sound devices, as the vulnerability exists in the kernel module that handles these devices. No specific version ranges are given, so any kernel exposing the vulnerable driver path is at risk.

The CVSS score of 7.0 indicates a high‑severity flaw, while the EPSS score of <1% shows a very low current exploitation probability. The vulnerability is not listed in CISA KEV. Because the flaw requires access to the virtio sound device and is immediately exploitable when the device is reset prematurely, the most realistic attack vector is local or privileged – remote exploitation would require additional conditions not described in the advisory. Information about privilege escalation or arbitrary code execution is not present in the CVE description and is therefore not asserted as fact.