The Linux kernel driver for the f81604 USB controller failed to anchor URBs (USB Request Blocks) in the read bulk callback before submission. When an anchored URB is submitted without proper anchoring, the kernel could retain a reference to the URB even after usb_kill_anchored_urbs() is called, potentially leaking resources and sensitive data. This flaw represents a reference counting leak (CWE‑771) and could lead to memory corruption, unintended disclosure of private data, or a denial‑of‑service condition if an attacker can force repeated faulty submissions.

This issue is present in the Linux kernel where the f81604 driver is compiled and used. It affects all Linux kernel installations that include this driver and have not been updated with the mitigated source code. Vendor information is listed as Linux:Linux for both CNA and CPES entries. No specific kernel version range is provided in the advisory.

The exploit probability (EPSS) is reported as less than 1 %, and the vulnerability is not listed in CISA’s KEV catalog, indicating a low likelihood of exploitation. The attack path requires a USB device that communicates with the f81604 controller and triggers the read bulk operation. Because the flaw requires interaction with specific hardware and kernel code, it is likely limited to local or physical access scenarios. Given the low EPSS score and absence from KEV, the overall risk remains low, but patching is advised to eliminate the reference counting flaw.