In the Linux kernel USB target driver, the f_tcm gadget can dereference a pointer to a nexus structure, tpg->tpg_nexus, without checking that it is non‑NULL. If a USB host sends a Bulk‑Only Transport command while the nexus is still being established or immediately after it has been dropped, the driver accesses tv_nexus->tvn_se_sess on a NULL pointer, triggering a kernel panic that halts the system. The weakness is classified as CWE‑476.

The flaw affects all Linux kernel releases in which the f_tcm gadget is compiled and enabled. The affected product listed in the CPE catalogue includes the generic linux_kernel platform, as well as kernel versions 7.0 releases candidate 1 through 4. All Linux distributions that ship a kernel containing the unpatched gadget are impacted, regardless of how the kernel is packaged.

The CVSS score of 5.5 reflects a moderate severity local denial of service. The EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog, indicating that it is currently considered low probability of widespread exploitation. Because the driver runs in kernel space, an attacker must physically connect a USB host capable of sending the vulnerable BOT command; remote exploitation is not possible. Exploitation requires a timing window between nexus creation or destruction, making the attack technically complex but not impossible if an adversary gains physical access to the device.