The vulnerability resides in the ALSA USB audio driver for UA‑101/UA‑1000 devices. It allows a mismatch between capture and playback packet sizes to cause an out‑of‑bounds write in the kernel when packaging packets for playback. The memory overwrite occurs during the open() of the PCM node and can corrupt arbitrary kernel memory, creating an exploitable condition that may enable arbitrary code execution with kernel privileges.

The flaw affects Linux systems that load the ALSA USB audio driver for UA‑101/UA‑1000 hardware. No specific kernel versions are listed in the advisory, so any kernel that includes the unpatched ALSA driver module is potentially vulnerable. Users of commercial or stock distributions should verify whether their kernel package contains the legacy ALSA usb_misc/ua101.c code path.

Because the flaw is an out‑of‑bounds write triggered only by a specially crafted USB audio device, the attack requires physical or network access to a target that accepts the USB device. This is inferred from the description which shows the driver cross‑checks packet size parameters but fails to relate capture and playback max_packet_bytes, allowing a mismatch to cause a buffer overflow during playback. The CVSS score of 7.8 indicates high impact, while the EPSS score of less than 1 % suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, but the code path could be leveraged for kernel privilege escalation.