The rt2x00usb USB driver in the Linux kernel incorrectly ties device resources to the parent USB device instead of the USB interface, causing memory to remain allocated when the driver is unbound without the device being physically disconnected. This flaw leads to gradual memory exhaustion when drivers are repeatedly unbound, such as during probe deferral or configuration changes. The primary consequence is a non‑remote denial of service through memory depletion, and the weakness corresponds to CWE‑401 (Memory Management).

The vulnerability affects Linux kernel systems that include the rt2x00usb driver. The known CPE set lists kernels from version 4.7 through the 7.0 release candidates. Any distribution or vendor whose kernel build includes this driver without the recent commit that fixes the devres lifetime is at risk.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The issue is not listed in CISA’s KEV catalog. The likely attack vector is local manipulation of USB interfaces that triggers driver unbinding, so an attacker with local or removable USB access could repeatedly load and unload the driver to exhaust memory and disrupt system stability, but the flaw does not provide remote code execution or privilege escalation.