The vulnerability is a memory‑allocation fault in the Linux CAN MACB USB driver. When a USB inbound transfer completes, the USB framework unanchors the endpoint request block (URB) before the driver’s complete callback processes it. The callback then attempts to free the URB via usb_kill_anchored_urbs, which only releases anchored URBs. Because the URB had already been unanchored, it is never freed, and each completed transfer leaves an orphaned object in kernel memory. Accumulation of such stray URBs can exhaust kernel memory and lead to a denial‑of‑service condition. This is a classic memory‑leak weakness identified by CWE‑401.

The flaw affects all Linux kernel releases that ship the mcba_usb subsystem and that have not yet incorporated the anchoring fix. The relevant CPE entries include the generic linux:linux_kernel family as well as the 6.19 release candidates (rc1 through rc6). Users should verify that their running kernel version appears in those CPE listings and the change is not yet applied.

The CVSS score of 5.5 categorises the issue as moderate severity, while the EPSS score of less than 1 % indicates a very low probability of exploitation in the wild. It is not listed in the CISA KEV catalog. Exploitation would require an attacker to generate sustained USB traffic through a MACB CAN device that is in use. The need for persistent traffic from a device attached to the compromised host is inferred from the description; no remote code execution or privilege escalation is described.