The flaw arises in the kaweth USB network driver in the Linux kernel, where the napi function kaweth_set_rx_mode() incorrectly calls netif_wake_queue() before the pending transmit USB Transfer Request Block (URB) has finished. This premature wake re‑enables the transmit queue, allowing a second usb_submit_urb() on the same URB while it is still active. The kernel emits a warning ‘URB submitted while active’, and repeated occurrences can result in kernel instability or a crash, effectively disrupting device operation and overall system availability.

This vulnerability affects all Linux systems running a kernel with the kaweth driver until the patch that removes the TX queue manipulation in kaweth_set_rx_mode() is applied. The specific vendor and product are Linux kernels from any distribution that include the default kernel image containing the affected driver code; versions prior to the commit introducing the fix are impacted.

The attack vector is inferred to be local, requiring an attacker with the ability to trigger the setsockopt or similar system calls that cause a change in multicast mode on the device, which typically requires at least kernel or root privileges. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating limited current exploitation evidence. However, the potential for kernel panic makes the CVSS score high enough to warrant prompt remediation, especially in production environments that rely on the affected USB network interface.