A malicious USB device masquerading as a CDC Phonet modem can send an unbounded sequence of full‑page bulk transfers, which causes an overflow of the skb_shared_info->frags array within the Linux kernel's CDC‑Phonet driver. The overflow can corrupt kernel memory, potentially allowing an attacker to execute arbitrary code with kernel privileges or to crash the system.

The vulnerability affects all Linux kernel versions prior to the application of the fix contained in commit 600dc405 and related patches. All standard kernel distributions that include the cdc_phonet driver are impacted, regardless of edition, unless the module has been removed or the kernel has been updated to a version containing the fix.

The CVSS score of 5.5 indicates a medium impact, while the EPSS score of less than 1% suggests a low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a local attacker who can physically attach a malicious USB device to the target system. Because the flaw resides in kernel memory handling, successful exploitation could lead to privilege escalation or denial of service. The patch mitigates the overflow by dropping the skb and recording a length error when the fragment limit is reached, but systems running unpatched kernels remain at risk.