The vulnerability resides in the Linux kernel’s rtl8152 USB driver, where the resume routine calls reset while holding the device control mutex, and the reset path re‑enters the driver attempting to acquire the same mutex again. This recursive locking can trigger a deadlock that manifests as a DPM timeout after ten seconds and a kernel panic after an additional fifteen seconds, disrupting system availability. The flaw is an instance of resource exhaustion that causes an uncontrolled lock contention leading to a system halt and is classified as CWE‑667, rather than affecting confidentiality or integrity.

Vulnerable kernels include Linux kernel version 6.19 release candidates 1 through 8. Any system running any of the rc8 variants or earlier pre‑release forms of that branch is impacted. The issue is resolved in later kernels beyond rc8, where the deadlock condition is eliminated.

With a CVSS score of 5.5 the weakness poses a moderate risk. Its EPSS score is below 1% and it is not listed in the CISA KEV catalog, implying a low probability of widespread exploitation. The likely attack vector requires local access that can trigger a USB resume event, such as removing and reconnecting an rtl8152 device. Once triggered, the deadlock may render the kernel unresponsive, enabling a denial‑of‑service scenario.