A kernel function that controls USB power draw was executing in an atomic context, inadvertently calling power‑management APIs that are allowed to block. Because these APIs can sleep, the function sometimes deadlocked the kernel, producing a crash. The fix moves the power draw operation into a workqueue so that sleeps are safe, eliminating the crash risk. The primary consequence of the vulnerability is an availability failure: a driver or attacker that triggers the buggy call could bring the system down by forcing a kernel panic.

All Linux kernels that contain the dwc3 gadget subsystem prior to the patch that moved the vbus draw into a workqueue. The patch was applied to the mainline kernel; the exact version range is not specified, so any build from the time before the commit should be considered vulnerable.

No EPSS score is available and the CVE is not listed in CISA's KEV catalog, indicating low publicly known exploit activity. The issue is a local availability bug that requires ability to influence the USB gadget driver, so the attack vector is likely local or requires physical access. Given the severity of a kernel panic, the risk remains high if an attacker can trigger the condition; however, the lack of observed exploitation reduces immediate threat urgency. The vulnerability remains serious because a kernel crash can lead to data loss and denial of service.