The f_ecm USB gadget driver allocates a network device during its initialization and registers it under the gadget’s sysfs hierarchy. When the gadget is unbound, the parent device is destroyed while the net_device remains allocated, leading to a dangling symlink that points to a non‑existent object. This improper cleanup can confuse the kernel’s power management and sysfs subsystems, potentially resulting in device‑tree inconsistencies or kernel panics if the stale reference is accessed. Based on the description, it is inferred that the primary outcome is resource leakage and instability rather than a direct data confidentiality breach.

All Linux kernel builds that incorporate the unpatched f_ecm driver are affected; the issue resides in the generic Linux kernel code referenced by the CPE and is not limited to any particular distribution or kernel version.

The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker must have privileged or administrative access to load, unload, or otherwise manipulate the USB gadget driver to trigger the unbind–bind lifecycle. The lack of an exposed remote vector suggests the threat is confined to the host where the vulnerable driver is active. The overall risk can be considered moderate, dependent on the environment’s USB gadget configuration and the privilege level of potential attackers.