The Pegasus USB driver in the Linux kernel does not validate the number and types of USB endpoints before binding. A malicious or malformed device that provides fewer or different endpoints can cause the driver to later access invalid endpoints, resulting in a kernel crash. This leads to a denial of service by disrupting system availability and possibly requiring a reboot.

The vulnerability impacts Linux kernels that include the Pegasus USB driver. No specific version range is provided, implying that all current kernel releases containing this driver are potentially affected. This includes mainstream distributions shipping the mainline kernel with the Pegasus driver active.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability does not provide remote code execution. Based on the description, the likely attack vector is a physical or authenticated USB connection, requiring an attacker to attach a crafted device to a vulnerable host. Since the vulnerability is not listed in the CISA KEV catalog and exploits would only cause a system crash, the overall risk is limited to service disruption rather than data compromise.