The vulnerability consists of a use‑after‑free in the DWC2 USB controller driver within the Linux kernel. After a USB request block (URB) is released via usb_hcd_giveback_urb(), the debug code may subsequently dereference the same URB pointer, writing to freed memory. This memory corruption can cause kernel crashes, and it is inferred that, in the unlikely event that an attacker can influence the freed object, arbitrary code execution might be possible. The flaw is confined to debug paths, so normal USB operation is unaffected unless debug logging is enabled.

All Linux kernel configurations that include the DWC2 USB controller driver without the pending patch are at risk. The vulnerability is present in any kernel released before the commits linked in the advisory. Because version specifics are not provided, all current Linux kernel releases containing the DWC2 module are considered vulnerable until the fix is applied.

The CVSS score of 7.8 classifies the issue as high severity. The EPSS score of <1% indicates a very low likelihood of exploitation in the wild, which aligns with the vulnerability being limited to debug code paths. The issue is not listed in CISA KEV, so no known widespread attacks have been reported. The likely attack vector requires an attacker to have physical or direct access to the target system and to trigger the driver’s debug features, a scenario typical of development or troubleshooting environments. Thus, while the theoretical impact could be significant, the practical exploitability is constrained to niche use cases.