The ALSA USB audio driver contains an out‑of‑bounds write in the function preparing playback URBs. When an implicit feedback device reports a packet count larger than the endpoint’s URB capacity, the driver writes beyond the allocated iso_frame_desc array, corrupting kernel memory. This corruption can lead to a kernel panic, data leakage, or an attacker gaining arbitrary execution at kernel privilege level.

All Linux kernel releases that include the ALSA usb‑audio subsystem and support USB audio devices are affected. The vulnerability is tied to devices implementing the UAC2 standard with differing bInterval values for capture and playback endpoints. Any system that accepts plug‑in USB audio hardware or exposes USB devices through usbip is vulnerable, regardless of vendor, as the issue resides in the core kernel code.

The CVSS score is 7.0, but the nature of the bug – a heap‑based buffer overflow discovered via KASAN – indicates a high severity event. EPSS score < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting no current widespread exploitation reports. The attack vector is likely a physical USB connection or a remote USB over IP session. Successful exploitation requires the attacker to cause the driver to process a crafted USB audio device with the mismatched packet counts, resulting in memory corruption. Once executed, an attacker can potentially escape privileged isolation or crash the system for denial of service.