The Pegasus USB driver in the Linux kernel validates that the device it is probing has the correct number and types of USB endpoints before it binds to it. If a malicious device supplies fewer or different endpoints, the driver will later attempt to access these invalid endpoints and crash the kernel. This results in a denial of service by disrupting system availability, possibly requiring a reboot and causing temporary loss of service for any users relying on the host.

The vulnerability affects Linux kernels that include the Pegasus USB driver. No specific version range is provided, which implies that all current kernel releases shipping this driver are potentially impacted. This includes mainstream distributions that use the mainline kernel with the Pegasus driver compiled in.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability does not provide remote code execution. Based on the description, the likely attack vector is a physical or authenticated USB connection, requiring an attacker to attach a crafted device to a vulnerable host. Since the vulnerability is not listed in the CISA KEV catalog and exploits would only cause a system crash, the overall risk is limited to service disruption rather than data compromise.