The ALSA core of the Linux kernel contains a use‑after‑free vulnerability that can occur when a sound card is released asynchronously. During this process the card’s underlying device may still be referenced by in‑flight tasks, allowing a freed memory region to be accessed after the card has been disconnected. This flaw can lead to memory corruption inside the kernel and, if an attacker can control the freed memory contents, potentially arbitrary kernel code execution.

Any system running the Linux kernel with the ALSA subsystem and not yet updated to the kernel version that includes the patch is vulnerable. This includes any Linux distribution that ships a kernel prior to the fix, regardless of vendor. The flaw affects any audio driver that invokes snd_card_free_when_closed(), such as USB‑audio devices. The public CNA data do not provide specific kernel versions, so the affected revision information is not available.

The EPSS score for this flaw is below 1 % and it is not listed in the CISA KEV catalog, which suggests that known exploits are rare. However, the lack of exploit data does not mitigate the potential impact. The CVSS score of 7.0 indicates a high severity risk. Based on the description, it is inferred that an attacker would need local or privileged access to trigger the flaw; once an attacker can cause an asynchronous release of a sound card, the kernel may execute arbitrary code or crash. Consequently, the theoretical risk is high for vulnerable hosts.