The Linux kernel mdc800 USB driver contains a flaw where a download URB is not cancelled after a timeout. When the device does not respond, the driver leaves the URB active; a subsequent read() resubmits the same URB and triggers the kernel warning 'URB submitted while active'. This indicates that resources expected to be freed remain allocated, creating a potential resource leak within the USB subsystem. The weakness is classified as CWE‑366.

All Linux kernel builds that include the unpatched mdc800 driver are affected. The affected products are any kernels compiled against the vulnerable code before the fix commit that adds timeout handling, spanning historic releases such as 2.6.x and recent 7.x release candidates., as identified by the CPE list provided.

The CVSS score of 5.5 shows moderate severity, and the EPSS score is less than 1%, indicating a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The required environment for an exploit is not explicitly described in the advisory, but based on the driver’s behavior it is inferred that a local USB mdc800 device must be present to trigger the timeout scenario. No public exploit code is known, and the impact is limited to a kernel warning and potential resource consumption."