The Linux kernel routine that removes a sideband USB endpoint incorrectly assumes the endpoint’s transfer ring is still valid. When the ring has been freed or never initialized, the routine dereferences a dangling pointer, causing a kernel panic. If this occurs during suspend, wake‑up, or device re‑enumeration, a local user or an attacker who can influence USB device state can trigger a crash, resulting in system reboot or unavailability.

Kernel builds that include the xHCI sideband driver, specifically Linux kernel releases from 6.16 onward and all 6.19 release‑candidate series (rc1 through rc8). Any system running these kernels with standard USB subsystem enabled is susceptible.

The CVSS base score is 5.5, indicating moderate severity. EPSS is less than 1%, and the vulnerability is not noted in CISA’s KEV catalog. The attack vector is likely a local or device‑side event during USB suspend/resume or re‑enumeration, rather than a remote network attack. Although the crash does not directly compromise confidentiality or integrity, it can be used to disrupt availability, especially in environments where USB devices are frequently suspended or reconnected.