The vulnerability occurs in the ALSA line6 driver of the Linux kernel, where playback USB requests are given a buffer slice sized for the OUT endpoint. The driver copies data using the frame count derived from the IN endpoint, without checking that the resulting length fits within the allocated slice. This missing bounds check can cause the memcpy or memset to write beyond the buffer, leading to a slab‑out‑of‑bounds write as captured by KASAN. Such a kernel memory corruption can allow an attacker to overwrite arbitrary kernel data, potentially enabling privilege escalation or denial of service. The bug is a classic heap buffer overflow that compromises kernel integrity.

The flaw affects all Linux kernel installations that include the ALSA line6 audio driver. Any system using a USB audio device that implements the line6 driver and that presents a larger IN wMaxPacketSize than the OUT wMaxPacketSize is vulnerable. The vulnerability is present in all current kernel releases prior to the fix and will be present until the kernel is updated to a version that implements the patch.

The potential impact includes kernel panic and possible arbitrary code execution with system privileges. The absence of a built‑in back‑stop, as noted in the description, makes the flaw likely easier to exploit than typical USB bugs. The CVSS score of 6.2 indicates medium severity, the EPSS score of <1% indicates low exploitation probability, and it is not listed in the CISA KEV catalog. Given these characteristics, security teams should treat the vulnerability as moderate risk and prioritize mitigation.