The vulnerability in the Linux kernel arises from improper handling of device‑managed resources in USB drivers. When a driver is unbound—without the corresponding USB device being physically disconnected— the associated control message buffer remains allocated. This oversight causes memory leaks that can lead to resource exhaustion or system instability in affected kernel versions. The likely attack vector is local privileged access that triggers repeated bind and unbind operations, potentially allowing an attacker to exhaust kernel memory.

All Linux kernel releases that contain the legacy USB driver code before the commit that fixes devres lifetime are affected. The issue is tied to the can: ucan subsystem and USB interface management. No specific minor release numbers are listed, so all kernel versions preceding the described fix are impacted.

The CVSS score is not provided and the EPSS score is not available, so the exploitation likelihood cannot be quantified from the data. The flaw is not listed in the CISA KEV catalog, suggesting no widespread exploitation has been observed. However, a local privileged attacker could exploit the memory leak by repeatedly unbinding drivers, potentially leading to a denial of service. Remote exploitation would require privileged access to invoke driver operations.