A race condition exists in the Linux kernel MCTP USB driver where a URB may remain queued after the device is stopped. If the URB completes, it can re‑schedule retry work, potentially causing continual resubmission and kernel instability. The resulting effect is a denial of service through a possible kernel crash, which disrupts availability for the affected system. This weakness is identified as CWE‑367.

All Linux kernel releases that include the MCTP USB stack and do not contain the atomic update to the rx lock and URB cancellation used in the fix. System kernels built before the commit that introduced the lock separation are potentially vulnerable.

The CVSS score of 7.8 indicates a high severity impact, while the EPSS score of less than 1% suggests a very low present exploitation probability. The CVE description does not disclose an explicit attack vector; however, because the race occurs during device shutdown and retry work, the most likely exploitation scenario involves local access to bring the kernel into the vulnerable state. The vulnerability is not listed in CISA’s KEV catalog.