A failure in the usb_submit_urb() routine during the usbio_probe() sequence can cause a previously allocated USB Request Block (URB) to remain allocated because the error path does not free the memory. This memory leak can accumulate over time and consume kernel RAM, potentially leading to a denial‑of‑service scenario where the kernel runs out of memory or must swap unexpectedly. The weakness is a classic resource‑management flaw that violates proper cleanup semantics for dynamically allocated kernel objects.

The vulnerability is present in the Linux kernel itself, affecting all kernel releases that include the usbio driver code prior to the patch referenced in the provided commits. No specific kernel version range is listed, so any system running an unpatched Linux kernel is potentially impacted.

The CVSS score is 5.5, and the EPSS score is not available, so the exact quantitative risk cannot be derived from the data. The vulnerability is not listed in CISA KEV, suggesting no known widespread exploitation. However, because the flaw can be triggered during normal USB device initialization, an attacker with local privilege or the ability to force a device probe could repeatedly trigger the leak, leading to gradual memory exhaustion. The likely attack vector is local; the flaw is manifested during driver initialization, implying that a privileged process that can cause usbio_probe() to run under error conditions can exploit it.