The vulnerability arises when the USB serial driver for the mct_u232 device mistakenly overrides the maximum transfer size for a bulk‑out endpoint that only accepts 16‑byte packets. This miscalculation can cause a slab corruption in the kernel memory allocator, which may lead to arbitrary code execution or a kernel crash if an attacker supplies a device reporting a smaller endpoint maximum packet size than the driver expects.

Any Linux system running the mct_u232 USB serial driver is potentially affected. No specific kernel version numbers are listed in the data, so all implementations of the driver prior to the referenced patch are considered vulnerable.

The EPSS score is less than 1 % and the vulnerability is not recorded in CISA’s KEV catalog, indicating a low likelihood of widespread exploitation at present. Nevertheless, the nature of the flaw—kernel memory corruption—means that if an attacker can present a malicious USB device to the affected system, there is a risk of arbitrary code execution with kernel privileges. No exploitation reports are available, but the severity remains high given the potential impact on system confidentiality, integrity, and availability. The CVSS score of 7.0 indicates a high severity level.