The vulnerability exists in the Linux kernel’s USB‑Type‑C UCSI firmware update path, where firmware images lacking a ':' record header are processed without proper validation. When such a firmware image is written to the do_flash sysfs attribute, the kernel mistakenly treats a NULL pointer as a valid address and performs an out‑of‑bounds read, causing a kernel panic. The flaw surfaces when an unsigned firmware blob is placed in /lib/firmware and then flashed. This results in a loss of system availability for the affected host, as the kernel crashes and requires a reboot.

All users running the Linux kernel before the commit that added the missing header check are affected. The flaw resides in the usb:typec:ucsi:ccg subsystem and applies to any kernel that implements the UCSI firmware update path. No particular kernel versions are enumerated in the advisory, so any kernel build that predates the patch may be vulnerable.

The EPSS score is below 1 % and the vulnerability is not listed in CISA’s KEV catalog, indicating a low expected exploitation probability. However, the attack requires local root privileges to place a crafted firmware file in /lib/firmware and to write to the do_flash sysfs attribute. Once those prerequisites are met, the exploit can be executed immediately and will crash the kernel. Non‑privileged users cannot exploit the flaw, and there is no remote exploitation vector identified.