The kaweth driver in the Linux kernel does not validate the number or type of USB endpoints it binds to. A malicious USB device that lacks the expected Endpoint URBs causes the driver to attempt to access non‑existent or mismatched endpoints, leading to a kernel crash and subsequent panic. This results in a denial of service for the affected system. The weakness is an instance of CWE-1288, demonstrating a failure in proper input validation before usage of external data. The crash occurs because the driver blindly dereferences pointers to endpoints without confirming the device’s configuration matches its expectations.

Any Linux kernel build that includes the kaweth driver and has not yet incorporated the validation fix is affected. The CPE list indicates this applies to all publicly released kernels from early 2.6.12 through at least Linux 7.0‑rc1, so any host running one of these kernels and capable of loading the kaweth module is within the risk scope.

The CVSS score of 5.5 indicates a moderate severity impact. The EPSS score of less than 1% reflects a low expected exploitation probability in the wild. The vulnerability is not listed in CISA’s KEV catalog. Exploitability requires the attacker to provide a crafted USB device to a target system. Based on the description, the likely attack vector is local physical access to plug a malicious USB device, making this a local attack scenario.