The Linux kernel vulnerability results from improper handling of device‑managed resources in USB drivers. When a driver is unbound without the physical USB device being disconnected, the associated control message buffer remains allocated, causing a memory leak. This flaw meets the characteristics of a memory‑leak (CWE‑401). The likely attack vector is local privileged access that triggers repeated bind and unbind operations, potentially allowing an attacker to exhaust kernel memory, leading to system instability or denial of service.

All Linux kernel releases containing legacy USB driver code before the commit that fixes devres lifetime are impacted. The issue is tied to the can: ucan subsystem and USB interface management. Specific minor release numbers are not listed, so all kernel versions preceding the described fix are affected.

The CVSS score of 5.5 and the EPSS score below 1% indicate a moderate severity with a very low but non‑zero exploitation probability. The flaw is not listed in the CISA KEV catalog, suggesting no widespread exploitation has been observed. A local privileged attacker could exploit the memory leak by repeatedly unbinding drivers, potentially leading to a denial of service. Remote exploitation would require privileged access to invoke driver operations.