The Linux kernel's dwc2 gadget subsystem contains a mismatch between spin_lock and spin_unlock in dwc2_hsotg_udc_stop. The function calls dwc2_gadget_exit_clock_gating without holding the required lock, which causes a spin_unlock on a lock that is not held (undefined behavior). The lock remains held after the call, and subsequent attempts to acquire it with spin_lock_irqsave fail, resulting in a deadlock. An attacker could trigger this by interfacing with the USB gadget driver, potentially freezing the system or causing a kernel panic. This flaw could be exploited locally on a system that runs the unpatched kernel and has a USB gadget device that invokes the buggy path. The likely attack vector is inferred to be local via interaction with the USB gadget subsystem.

All Linux kernel builds that include the dwc2 gadget subsystem and still contain the unfixed version of dwc2_hsotg_udc_stop. No specific release list is provided, so any kernel version that has this code before the fix may be vulnerable.

The CVSS score is 7.0, indicating a high-impact denial of service. The EPSS score is not available. An attacker would need local or physical access to a USB gadget device to trigger the deadlock; remote exploitation is not implied. The flaw is not listed in CISA KEV, suggesting no confirmed exploits yet, but the potential for system unavailability remains significant.