In the Linux kernel, a mismatch between spin_lock and spin_unlock in the dwc2 gadget subsystem causes the function dwc2_hsotg_udc_stop() to release a lock that was never held and to leave the lock in a held state. The call to dwc2_gadget_exit_clock_gating() expects the lock to be held and invokes a callback that performs a spin_unlock, leading to undefined behaviour. When this occurs, a subsequent attempt to acquire the same lock with spin_lock_irqsave() fails, resulting in a deadlock that can freeze the kernel or provoke a panic, effectively denying service.

All Linux kernel releases that ship the dwc2 gadget driver and contain the unpatched dwc2_hsotg_udc_stop() logic are affected. The vulnerability is present in the kernel source prior to the fix introduced by the provided commits; any kernel build that has not yet incorporated this change remains vulnerable.

The CVSS score of 5.5 reflects a medium‑to‑high impact denial of service. The EPSS score is reported as < 1%, indicating a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, suggesting no known exploited instances. The flaw can be triggered locally by interacting with a USB gadget device that drives the buggy path; remote exploitation would require the attacker to have physical or local access to a device that enables the dwc2 gadget subsystem.