The vulnerability is a race condition between rawmidi operations and USB disconnect handling in the Linux ALSA bcd2000 driver. When a rawmidi trigger callback is executing while the device disconnects, the callback may still reference a USB Request Block that has been cleared or freed, potentially corrupting kernel memory or leading to undefined behaviour. A fix was introduced by adding a spinlock to serialize rawmidi calls and the disconnect routine.

All Linux kernel releases that include the unchanged ALSA bcd2000 driver are affected. The patch that introduces a spinlock to protect rawmidi operations and the USB disconnect routine was applied to the stable kernel stream after the issue was discovered, but the advisory does not specify the precise kernel versions. Consequently any system running a kernel prior to the patch commit remains vulnerable until the kernel is updated.

The EPSS score of < 1% indicates a very low probability of exploitation. Based on the description, it is inferred that an attacker would need to initiate a USB audio device disconnect while a rawmidi callback is in progress, a scenario that might be achieved via local interaction with the device or an application that can trigger it. If the conditions are met, the race can cause kernel instability, potentially leading to a crash or other denial‑of‑service behaviour. The vulnerability is not listed in the CISA KEV catalog and no public exploitation evidence is known.