The Linux kernel contains a race condition in the USB Yurex driver. If the bbu member of the descriptor is not pre‑initialized to a sentinel value before the URB is submitted, the probe routine can overwrite data that has already been retrieved. This flaw, which falls under CWE-367, can corrupt device descriptor structures in kernel memory, potentially causing kernel instability or a denial of service.

The flaw affects Linux kernel builds that include the Yurex USB driver. No specific kernel version numbers are given in the CVE data, so any kernel prior to the patch referenced in the commit URLs may be vulnerable. The affected product is the Linux kernel, and the vulnerability is present in all distributions that ship an unpatched version of the Yurex driver.

The EPSS score is < 1%, indicating a very low but non‑zero probability of exploitation. The CVSS score is not available in the CVE data, and the vulnerability is not listed in CISA's KEV catalog, so the quantitative severity remains uncertain. The attack vector requires control over USB device enumeration, implying a local or external threat where the attacker can supply or manipulate a Yurex USB device. Because the race condition operates within privileged kernel code, successful exploitation would need sufficient privilege, but the risk is moderate to high in environments that accept untrusted USB devices and have not applied the kernel update. No publicly available exploit has been disclosed.