The vulnerability is a memory leak in the Pegasus USB device driver. When an asynchronous register write operation fails, the driver fails to release allocated resources, allowing the leak to accumulate. This can eventually exhaust system memory and degrade performance or cause a denial of service. The flaw is a classic memory management issue, classified as CWE‑401.

Any Linux kernel system that includes the Pegasus USB driver, including mainstream releases and the 6.19 release candidates. The affected code is part of the USB networking subsystem of the Linux kernel, so any distribution shipping a kernel with that driver is potentially compromised.

The CVSS score of 5.5 indicates moderate severity. The EPSS score of less than 1% suggests that exploitation is unlikely, and the vulnerability is not yet listed in the CISA KEV catalog. The attack vector appears to be local or requires elevated privileges, as the attacker must provoke a failed USB submit operation in the driver. Based on the description, it is inferred that the vulnerability requires some control over the USB device or kernel module interactions, making it an indirect yet realistic risk for systems that accept unmanaged USB devices.