The Linux kernel's USB gadget functions for UAC1 and UAC2 parse comma-separated lists of sampling rates into fixed-size arrays with a maximum of 10 entries (UAC_MAX_RATES). Prior to the fix, the code did not check that the input contained at most 10 tokens before writing, allowing writes past the end of the arrays p_srates[] or c_srates[]. This out-of-bounds write can be detected with CONFIG_UBSAN_BOUNDS enabled, which reports array-index-out-of-bounds errors. The fix involves rejecting additional tokens once the maximum number of entries is reached and properly managing the memory pointer used during parsing to avoid leaks or invalid frees.

This vulnerability allows writing beyond the bounds of fixed-size arrays in kernel memory, which can lead to memory corruption. The CVSS score of 7.8 indicates high severity with potential for confidentiality, integrity, and availability impacts. However, there is no known exploitation in the wild reported. The vulnerability requires local privileges (AV:L) and low complexity (AC:L) without user interaction (UI:N).

A fix has been implemented in the Linux kernel to validate the length of the rate list before storing values and to properly manage memory pointers during parsing. Users and administrators should apply the official kernel updates that include this fix. Since this is not a cloud service, manual patching is required. Patch status is not explicitly stated in the input data; check the vendor advisory for the latest remediation guidance.