In the Linux kernel the WebUSB GET_URL handler performs an unsigned subtraction to calculate the size of a URL descriptor. If the host supplies a wLength value smaller than the descriptor header length, the subtraction underflows and wraps to a very large value. The subsequent memcpy then attempts to copy near UINT_MAX bytes into a fixed-size kernel buffer, causing an out‑of-bounds write that corrupts kernel memory. This memory corruption could allow an attacker to overwrite kernel structures and potentially execute arbitrary code with kernel privileges, constituting a CWE-787 out-of-bounds write.

All Linux kernel builds that include the USB gadget subsystem with WebUSB support enabled (webusb/use=1) and a landingPage configured are affected. No explicit kernel version range is provided, so any installation that has the default WebUSB gadget configuration could be vulnerable until the patch is applied.

The EPSS score is below 1% and the vulnerability is not listed in CISA KEV, indicating a low current exploitation probability. The CVSS score of 7.0 indicates a moderate level of impact for a kernel memory corruption flaw. The likely attack vector requires a USB host that can send a crafted SETUP packet to the gadget; this could be achieved with physical access to a host or by compromising a host device that is able to communicate with the vulnerable gadget. The description indicates that a single packet is sufficient to trigger the bug, so the attack could be performed in an unattended or remote manner if the gadget is exposed to untrusted hosts.