The bug exists in the USB Network Controller Model (NCM) gadget driver of the Linux kernel. The ncm_set_alt function held a mutex to protect against races with configfs, but the mutex path calls a might‑sleep routine that is forbidden in atomic context, which is a classic instance of the concurrency control weakness described by CWE‑663 (Improper Locking) and the atomic context misuse described by CWE‑667 (Invalid Access to Sleep‑Prone Resource). This misuse can trigger a “sleeping function called from invalid context” fault, leading the kernel to panic or crash, which effectively results in an abrupt loss of service for processes relying on the USB gadget subsystem.

All Linux kernel releases that contain the pre‑fixed f_ncm driver code, as indicated by the listed CPEs, are vulnerable. The patch removes the mutex usage and replaces it with a boolean flag for connection state. Kernel builds that incorporate the commit that eliminates the atomic context violation are not affected, while older distributions or custom kernels without the update remain susceptible.

Based on the description, it is inferred that a local privileged user or an attacker controlling a USB gadget device could trigger the fault by exercising the ncm_set_alt path. The CVSS score of 5.5 reflects moderate impact, and the EPSS score of <1% indicates a low probability of exploitation in the wild. The vulnerability is not listed in CISA KEV, and no publicly available exploitation code is known.