The dummy‑hcd driver in the Linux kernel emulates USB interrupts by toggling an "interrupts enabled" flag and synchronizing callbacks. An earlier change caused the emulated interrupt disable to occur after callbacks had been scheduled, allowing the gadget driver to be unbound while a callback was still running. This race can lead to a callback executing in an invalid context, potentially corrupting kernel memory or crashing the USB subsystem, thereby harming system availability and integrity.

Any Linux kernel build that includes the dummy‑hcd module and has not been updated to the commit that relocates the synchronize_irq() emulation into dummy_udc_async_callbacks(). All mainstream distributions whose kernel versions precede that change are potentially affected; exact version boundaries are not specified in the data.

The flaw resides in a low‑level driver that is active only when the dummy‑hcd module is loaded. No public exploit is documented, and the vulnerability is not listed in KEV. The EPSS score is not available, suggesting limited exploitation probability. However, a local attacker who can load or unload the module or who has control over a USB gadget hosted by the kernel could trigger the race, resulting in kernel instability or memory corruption. Based on the description, it is inferred that exploitation would likely require local privileges and access to the USB gadget subsystem, though this is not explicitly stated in the input.