The kernel driver usbtmc releases pending anchored URBs without flushing or killing them, creating a use‑after‑free condition that can corrupt kernel memory and potentially cause system crashes. This flaw arises because usbtmc_release fails to handle anchored URBs properly, and the use of usbtmc_draw_down is required to let them complete safely. The vulnerability can lead to kernel memory corruption or crashes if an attacker controls a USB Test and Measurement Class device.

All Linux kernel releases prior to the inclusion of the commit that fixes usbtmc_release are affected. The issue is present in the generic Linux kernel source and not limited to a specific version number, so any system running an unpatched kernel may be vulnerable.

The CVSS score of 7.0 indicates that the flaw has medium to high severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. A local attacker who can attach a malicious USBTMC device can exploit the flaw by triggering usbtmc_release, leaving an anchored URB in a freed memory context, potentially causing a kernel panic or kernel memory corruption. The likely attack vector is local device attachment.