The defect lies in the media rc igorplugusb subsystem of the Linux kernel. When a USB device generates a control request, the kernel uses a request structure that may be accessed via DMA by certain host controllers. The code allocates this structure in ordinary memory, violating DMA coherency requirements, a weakness classified as both CWE‑788 (Use of Uninitialized or Improperly Initialized Data) and CWE‑821. This oversight can let a malicious USB device cause the host controller to read or write stale or incorrect data, leading to kernel memory corruption, which in turn threatens system stability and confidentiality.

Linux kernel builds that include the media rc igorplugusb driver are affected. The kernel source contains the vulnerability before the patch commit 0adac0ee2c42027d80bac02ea9b576a88f8955d3. Administrators should consider any kernel that has not yet applied this fix as potentially vulnerable, since no specific version range is detailed.

No public CVSS or EPSS rating is available, and the flaw is not listed in the CISA KEV catalog, indicating no known active exploitation. Nonetheless, a local attacker or an adversary with USB access to the host can craft control requests that trigger the flaw, potentially causing memory corruption. The lack of publicly disclosed exploits suggests the risk is moderate until the patch is deployed.