The vulnerability arises when the GS USB driver attempts to submit a USB Request Block (URB) and the operation fails. The code fails to unanchor the URB, so the kernel’s anchored list never becomes empty. During driver cleanup, usb_kill_anchored_urbs() enters an infinite loop, consuming CPU and preventing the driver from releasing resources. This flaw can result in a service interruption or kernel lock‑up in systems that use the CAN bus subsystem.

Affected systems are Linux kernel users with the gs_usb driver, specifically kernel releases 6.12.67, 6.18.7, and 6.19 rc6, as well as any kernel built from the same source that includes the same driver code.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The flaw is not listed in CISA’s KEV catalog. An attacker would need to interact with the CAN USB subsystem, likely with kernel‑level privileges or via an application that triggers the driver’s cleanup, such as closing a device file. While no public exploit is known, the infinite loop could be triggered by malformed or failed CAN USB requests, making it a viable denial‑of‑service vector in environments where the CAN bus is used.