The Linux kernel bug allows applications to issue USB control, bulk, or interrupt messages with unlimited timeout values. Because these calls use uninterruptible waits, a caller can inadvertently block a kernel task for an undefined period, potentially forever. The attack can cause resource exhaustion and lock up system services or prevent further task scheduling, effectively denying service for the user on the affected machine. This weakness corresponds to the CWE-770 identifier for unbounded wait loops.

The vulnerability affects the Linux kernel across all distributions and releases that have not yet implemented the 60‑second timeout cap introduced by the patch. The vendor/product information supplied in the CNA lists the product simply as Linux: Linux, matching the generic kernel. Therefore, all Linux kernel devices that rely on the usb_control_msg(), usb_bulk_msg(), or usb_interrupt_msg() APIs and lack the timeout restriction are potentially impacted until the fix is applied.

The EPSS score of < 1% indicates an extremely low probability of exploitation. The vulnerability is not listed in CISA's KEV catalog, further suggesting it is not a known widely exploited issue. Nonetheless, with a CVSS score of 5.5 the impact of an exploitation event could deny services locally if a user can invoke the affected USB APIs. The attack requires local USB device access and the ability to call the USB synchronous functions from user space, making it relevant primarily in environments that frequently communicate with USB hardware.