The Linux kernel bug allows applications to issue USB control, bulk, or interrupt messages with unlimited timeout values. Because these calls use uninterruptible waits, a caller can inadvertently block a kernel task for an undefined period, potentially forever. This can lead to resource exhaustion and lock up system services or prevent further task scheduling, effectively denying service for the user on the affected machine. The weakness corresponds to CWE-770 for unbounded wait loops.

The vendor/product listed is Linux: Linux, representing the generic Linux kernel. The bug affects all kernel releases that lack the 60‑second timeout cap introduced by the patch. Based on the description of the fix, it is inferred that any kernel version preceding the commit that added the timeout limit is vulnerable, regardless of distribution or distribution version.

The EPSS score of < 1% indicates an extremely low probability of exploitation. The vulnerability is not listed in CISA's KEV catalog, further suggesting it is not a known widely exploited issue. With a CVSS score of 5.5, the impact of an exploitation event could deny services locally. The likely attack vector requires local USB device access and the ability to invoke the affected USB synchronous functions from user space, making it most relevant in environments that frequently communicate with USB hardware.