The usbtmc driver in the Linux kernel accepts a timeout value from a user via an ioctl call and passes that value directly to usb_bulk_msg(). Because usb_bulk_msg() performs an unkillable wait, an attacker can supply an excessively large timeout, causing a kernel thread to block indefinitely. This creates a denial‑of‑service condition that can stall kernel activity and potentially exhaust system resources.

The vulnerable driver exists in all Linux kernel releases before the fix, affecting any system that exposes the usbtmc device interface and permits ioctl timeout manipulation.

The EPSS score of <1% indicates a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog; the CVSS score of 5.5 indicates a medium‑severity risk due to the potential for a local attacker to hang a kernel thread. The attack vector is local; a user with access to the usbtmc device and the ability to issue the ioctl can trigger the hang. Exploitation requires the attacker to run code that can open the device and send the specified ioctl. Once executed, the kernel thread remains busy until the timeout expires, causing a service interruption for the entire system.