The mdc800 USB driver has a flaw where a download URB is not cancelled after a timeout. As a result, the driver may leave an active URB in the system, and a subsequent read() will attempt to resubmit the same URB. This triggers the kernel warning "URB submitted while active" and indicates that resources that should have been released remain allocated, potentially leading to a resource leak within the USB subsystem. The flaw is associated with the CWE-400 category of uncontrolled resource consumption.

All Linux kernel builds that contain the unpatched mdc800 driver are affected. This includes any kernel that has not integrated the patch commit adding timeout handling. No specific kernel version is listed, so all kernels compiled with the vulnerable code prior to the fix are included.

The flaw appears to require local access to a USB mdc800 device that does not respond. No public exploit code is known, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is not available, so the likelihood of exploitation remains uncertain. In a scenario where an attacker can supply a non‑responsive USB device, the warning could be repeatedly triggered, but no direct denial‑of‑service impact has been documented.