The ALSA USB 6fire driver uses USB Request Blocks embedded in several structures, and the embedded URBs are reference counted incorrectly. When the URB is released asynchronously, the reference count can drop to zero while a pointer to the URB is still referenced elsewhere, resulting in a memory use‑after‑free. Based on the description, it is inferred that an attacker who can influence the handling of the driver could overwrite the freed memory and potentially execute arbitrary code, although this outcome is not explicitly confirmed in the advisory.

All Linux kernel releases that include the ALSA USB 6fire driver, such as the default kernel images shipped with most Linux distributions and their derivatives.

A use‑after‑free in a privileged kernel driver presents a high severity risk. The CVSS score is 7.0, and the EPSS score indicates a probability of exploitation less than 1%. The vulnerability is not listed in the CISA KEV catalog, which suggests limited public exploitation. The likely attack vector involves a malicious USB 6fire device physically connected to the target system, inferred from the driver’s nature and requirement a USB device. If exploited, the UAF could lead to system instability or privilege escalation, but the exact impact depends on the attacker’s ability to control the freed memory.