The vulnerability is a deadlock in the HID subsystem of the Linux kernel that occurs when a USB device containing both HID and storage or UAS components is reset. During the reset sequence, hid_post_reset() allocates memory while a mutex held for the reset can block on block I/O, causing the system to deadlock. The effect is a denial of service, leaving the system unresponsive until rebooted. The weakness is a concurrency locking flaw that prevents the kernel from completing a reset operation.

All Linux operands using the Linux kernel prior to the commit that introduced the GFP_NOIO change are affected. This encompasses mainstream distributions such as Ubuntu, Debian, Fedora, Red Hat Enterprise Linux, CentOS, and any other system shipping kernels that lack the fix. Any installation that has not incorporated the patch is vulnerable.

The EPSS score is not available and the vulnerability is not listed in CISA KEV, but its impact is substantial because a single device that can trigger the deadlock can render the entire kernel non‑responsive. The attack requires a physical USB device capable of resetting both HID and storage components simultaneously, which limits the exposure to environments where such devices are present. The risk is therefore moderate to high in constrained environments, and the severity is high due to the potential for complete system downtime.