The vulnerability is a use‑after‑free condition in the Linux kernel’s usbip vudc driver, triggered when the vudc_remove() path frees a vudc structure while a timer still references it. This race causes the timer core to dereference freed memory, allowing an attacker to corrupt kernel space. The flaw is a classic CWE‑825 lifetime bug that can lead to arbitrary kernel code execution or a kernel panic. The attacker would need local control over USBIP socket operations to trigger the race, giving them kernel privileges and effectively local privilege escalation.

All Linux kernel releases that include the usbip vudc driver before the patch commit are affected. The fix was incorporated in commit [link not provided], so any distribution running a kernel version that does not include this commit is vulnerable. Administrators should verify their kernel version against the patch and update to a kernel that incorporates the commit.

The EPSS score is less than 1% and the CVE is not listed in the CISA KEV catalog, which suggests the likelihood of exploitation is low. However, because the vulnerability provides kernel‑level privileges, the potential impact is high. The exploitation requires a local attacker who can manipulate USBIP socket operations and trigger repeated bind/unbind cycles to create the race. Overall, the risk is moderate: high severity but low probability of exploitation without an active local threat.