In the Linux kernel the Pegasus USB driver constructs URBs using hard‑coded endpoint numbers without validating the endpoint descriptors supplied by the device. A malicious or malformed USB device can advertise an endpoint with a transfer type that does not match the driver’s expectation, potentially causing an assertion failure or kernel crash when the URB is processed. This leads to a denial of service on the host system.

The vulnerability affects all Linux kernel releases that include the Pegasus USB driver, as well as other similar drivers that performed the same unchecked endpoint assignment. The patch is present in the upstream 6.x series; any kernel version prior to the merge of the relevant commits is vulnerable.

The absence of EPSS data makes quantifying the likelihood difficult, but the flaw can be exercised simply by connecting a crafted USB device to the host. The impact is a kernel crash or instability, and the vulnerability is local in that it requires physical access to the machine. While it is not listed in CISA’s KEV catalog, an affected system could be exposed to DoS attacks in environments where USB polling is common. Administrators should treat this as a moderate‑to‑high risk and act promptly.