This vulnerability arises from a use‑after‑free read in the Linux kernel’s ALSA line6 driver. When a capture stream is released, a pointer to the former capture buffer is not cleared, and later a playback operation dereferences that stale pointer. The result is a kernel memory read that can expose privileged data or enable further attacks against the kernel. The flaw is a classic use‑after‑free scenario and does not itself grant arbitrary code execution, but it can be leveraged as part of a larger exploitation chain to gain local privilege escalation or to disrupt system stability.

All Linux kernels that ship the ALSA line6 driver are affected until the kernel incorporates the fix that clears the previous buffer pointer when the capture stream buffer is freed. The attack surface includes any system that has the line6 USB audio device attached and loads the ALSA line6 module.

The CVSS score and EPSS value are not publicly available, so the exact severity and likelihood of exploitation are unknown at this time. The flaw is listed as not being part of CISA’s KEV catalog. The typical attack vector requires local access to the system, a capable line6 device and the ability to trigger the playback path after releasing capture streams. If the conditions are met, an attacker could read kernel memory and potentially use that information to mount a higher‑privilege exploit.