The vulnerability arises from the Linux kernel's USB gadget driver for the UAC1 legacy audio interface, specifically the functions generic_set_cmd() and generic_get_cmd(). These functions use the low nibble of the USB bRequest field as an index into a five‑element data array. When the index is 5–15, the code writes to or reads from memory beyond the array’s bounds, leading to an out‑of‑bounds read or write on the heap. This memory corruption can overwrite kernel data structures or read sensitive information.

Affected systems are all Linux kernel installations that include the f_uac1_legacy driver before the patch that added an ARRAY_SIZE guard. This includes any distribution kernel containing the unpatched gadget module, regardless of version, as the bug exists in the driver code before the commit referenced in the advisory. Administrators should verify whether their kernel package contains the unpatched f_uac1_legacy driver.

The risk is that a malicious USB host can send a crafted SET_CUR or GET_CUR request to trigger the out‑of‑bounds access. The CVSS score of 8.4 indicates a high severity, but the EPSS score is less than 1% and the vulnerability is not listed in CISA's KEV catalog, suggesting that public exploitation is not yet confirmed. Kernel memory corruption could cause a denial of service or, under certain conditions, a privilege escalation. The likely attack vector is physical or remote access through a USB device, which is inferred from the description of a malicious USB host and the requirement for the target to be exposed to potentially untrusted USB hosts. Administrators should consider the potential impact on availability and confidentiality when deciding on mitigations.