The Linux kernel contains a flaw in the ALSA ctxfi subsystem where the dao_clear_input() function removes DAO input mapper entries from a list and nullifies their pointers but does not free the underlying allocated memory. Each invocation of this function therefore leaks memory. Repeated leaks could exhaust memory resources and result in a denial‑of‑service condition for locally privileged users who can trigger the clearing operation. The weakness is a classic memory leak, classified as CWE‑772.

All Linux kernel packages that include the ALSA ctxfi module and that were built before the patch commit e576e7843c0d are vulnerable. This includes mainstream distributions and any custom kernels that have not applied the kernel source change. The vulnerability does not depend on a particular distribution or kernel release within the Linux kernel family.

Based on the description, the CVSS score of 3.3 and the EPSS score of < 1% are reported facts; however, it is inferred that the flaw requires local privileged execution or a privileged module to repeatedly invoke the clearing routine, since the memory is allocated within kernel space. Based on the description, it is inferred that a successful attack could consume significant memory, potentially crashing the kernel or severely degrading system performance. The vulnerability is not listed in the CISA KEV catalog, indicating no known active exploits, yet its DoS impact warrants timely remediation. Given the lack of published exploit evidence, the risk level can be considered moderate to high for environments where the kernel can be driven into repeated clearing loops.