The uvcvideo driver mishandles device descriptors that contain a zero or duplicated unit or terminal ID, which are required by the UVC specification to be unique and non‑zero. When such an invalid entity is encountered, the driver marks it with the flag UVC_INVALID_ENTITY_ID but continues processing, resulting in uninitialized data accesses and warning messages in the kernel log. In some configurations, this can trigger a kernel warning that may lead to a crash or panic, interrupting system operation. The vulnerability does not provide an arbitrary code execution path; its exploitation requires the injection of a malicious USB camera or similar device that supplies the malformed descriptor. The likely attack vector is a physical device connection.

The vulnerability affects any Linux kernel that implements the uvcvideo USB Video Class driver before the commit that added the UVC_INVALID_ENTITY_ID marker. This includes most current mainline kernels that have not yet incorporated the fix. Administrators should treat all distributions shipping unpatched kernels as vulnerable until the patch is applied.

Risk assessment shows a CVSS score of 7.0, indicating a moderate severity. The EPSS score is less than 1%, suggesting a very low probability of exploitation in the wild, and the vulnerability is not present in the CISA KEV catalog. Nonetheless, because the attack involves a direct USB connection and can cause a critical system crash, it should be treated with a low‑to‑moderate but non‑negligible risk, especially in environments where untrusted USB devices are permitted.