The Linux kernel audio subsystem contained a flaw where the rt1017‑sdca‑sdw codec driver passed an uninitialized stream_config structure to sdw_stream_add_slave. The incomplete type field could be garbage, resulting in an incorrect stream type being set in stream->type by sdw_config_stream, potentially causing misconfigured audio streams or a denial of service. This is a classic Use of Uninitialized Variable weakness (CWE‑457).

The vulnerability affects all Linux kernel releases that include the rt1017‑sdca‑sdw codec driver before the patch was applied. It applies to the Linux kernel as distributed by the Linux Foundation and any vendor that ships kernel versions without the fix. The CPE indicates the generic Linux kernel product; specific versions are omitted but should be compared against the commits referenced for the fix.

Severity is scored at CVSS 5.5; EPSS < 1%, indicating a moderate but still low exploitation probability. The flaw is limited to local kernel code, requiring privileged access to load or interact with the affected audio driver; it is not listed in CISA’s KEV catalog and no public exploits are documented. The risk to confidentiality, integrity, or availability is therefore moderate and largely depends on local access or compromise of the audio subsystem.