The flaw resides in the media rc igorplugusb subsystem of the Linux kernel. When a USB device performs a control request, the kernel creates a request structure that can be accessed via DMA by certain host controllers. The code allocates this structure in ordinary memory, violating DMA coherency rules, a weakness classified as CWE-821. Because of this misallocation, a malformed control request may cause stale or incorrect data to be read or written, leading to kernel memory corruption and potentially compromising system stability and confidentiality.

Linux kernel builds that include the media rc igorplugusb driver are affected. The vulnerability exists in any kernel that has not yet incorporated the upstream patch commit 0adac0ee2c42027d80bac02ea9b576a88f8955d3. Administrators should treat all kernels built without this patch as potentially vulnerable, regardless of the specific version number.

The CVSS score of 5.5 indicates a moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation. The flaw is not listed in CISA KEV. Based on the description, it is inferred that the attack vector likely involves a malicious USB device issuing crafted control requests that trigger the improper DMA mapping. While no publicly disclosed exploits exist, the potential for kernel memory corruption warrants timely patching if the system relies on the IgorplugUSB media driver.