The Linux kernel esd_usb driver can leak memory when completed USB read requests are not properly anchored, causing unused URBs to remain allocated and eventually exhausting RAM. This vulnerability does not directly facilitate arbitrary code execution or data disclosure, but it can degrade system stability and availability by leading to a local denial‑of‑service condition. The weakness is classified as a memory leak (CWE-401).

The flaw exists in the esd_usb driver of the Linux kernel, which handles CAN-over-USB. The driver is included in all kernel versions beginning with the 6.19 release candidates, but the exact versions are not specified by the CNA. Systems running these kernels without the fix are susceptible.

The CVSS score of 5.5 indicates moderate severity. EPSS data shows a probability of exploitability below 1%, meaning the likelihood of real‑world exploitation is low, and the vulnerability is not in the CISA KEV catalog. The attack vector is inferred to be local: an attacker with physical or administrative access to a USB ESD device must succeed. Exploitation requires the driver to process USB read traffic enough to accumulate unreleased URBs; no privilege escalation or remote code theft is involved.