In the Linux kernel Pegasus USB driver, URBs are constructed using hard‑coded endpoint numbers without validating the device’s endpoint descriptors. This omission allows a malformed USB device to supply endpoints with transfer types that differ from what the driver expects, leading to an assertion failure or kernel crash when the URB is processed. The result is a host‑wide denial of service. The weakness is a form of unchecked input error, identified as CWE‑1287.

The issue exists in all Linux kernels that include the Pegasus USB driver prior to the addition of explicit endpoint checking. Any kernel build with the unpatched Pegasus driver is vulnerable, regardless of version or patch level. Administrators should check whether the Pegasus module is loaded on their systems, particularly on older or custom kernel releases that may lack the fix.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of <1% shows a very low yet non‑zero likelihood of exploitation. The most plausible attack vector is a physical connection of a crafted USB device that triggers the driver’s probe routine, potentially causing a system crash. Exploitation requires local physical access to mount the USB device. The vulnerability is not listed in CISA’s KEV catalog.