The kernel’s USB gadget EEM driver previously allowed a network device to outlive its parent gadget during unbind operations, resulting in dangling symlinks under /sys/class/net. This bug exemplifies CWE‑459 (Improper Cleanup) and does not provide direct code execution or data exfiltration, but it can create orphaned system objects that may confuse interface enumeration tools and lead to subtle stability or resource management issues. Based on the description, it is inferred that exploitation requires privileged local actions such as invoking bind/unbind sequences, as these operations typically demand root or device ownership rights.

Any Linux kernel build that lacks the device_move fix, including distributions and custom kernels around the timeframe of the referenced git commits, is affected. The vulnerability is tied to the kernel itself, so any system running an unpatched kernel is potentially impacted.

No CVSS or EPSS data are available; the vulnerability is not listed in CISA's KEV catalog. The defect appears to require privileged local actions, inferred from the need to perform bind/unbind operations that normally require root or device ownership rights. No direct execution or data exfiltration capabilities are identified, and the effect is the creation of stale or orphaned sysfs entries, which may lead to resource management issues or confusion for network enumeration tools.