In the ALSA hda subsystem of the Linux kernel, a tracepoint is invoked after a PCM stream is opened but before its assignment is confirmed. When hardware streams are exhausted, the stream assignment may fail, leaving the stream tag NULL. The tracepoint’s payload then dereferences this NULL pointer, causing a kernel oops and system crash. This results in a denial of service to all users on the affected system without providing remote code execution or privilege escalation.

All Linux kernel installations that include the default ALSA hda audio driver, before the latest patch that reorders the tracepoint after the NULL check. The vulnerability applies to every distribution using the stock kernel source tree.

The vulnerability does not provide remote code execution or privilege escalation, but its impact is significant because a local user with audio access can force the kernel to crash. The CVSS score of 5.5 indicates moderate severity. The EPSS score indicates a very low exploitation probability (<1%). The vulnerability is not yet listed in CISA’s KEV, suggesting publicly known exploits are absent, yet the risk remains due to the severity of a kernel-level crash. An attacker who can trigger PCM open operations while exhausting streams can induce the crash, resulting in a denial of service to all users on the affected system.