The Linux kernel contains a race condition in the USB UVC gadget where the opts->lock mutex is not held while the extension unit list is traversed during function bind. This omission can allow a privileged userspace process to delete an extension subdirectory at the same time the kernel reads it, causing a use‑after‑free and potentially a kernel crash. The bug does not introduce a new privilege boundary and is therefore considered a correctness issue rather than a security flaw; however, a crash could lead to a denial‑of‑service.

Affected systems are Linux kernel versions that have not yet incorporated the commit fixing this race condition. Kernels built from source or distributed by vendors that include the default UVC gadget and configfs interfaces may be vulnerable. No specific version range is explicitly enumerated; administrators should verify whether their kernel contains the commit that holds opts->lock during uvc_function_bind.

The EPSS score is reported as less than 1 %, indicating a very low probability of exploitation in the wild. The CVSS score of 5.5 indicates moderate severity. The defect is not listed in CISA’s KEV catalog. Exploitation requires root or CAP_SYS_ADMIN privileges to mount the configfs filesystem and manipulate the UVC gadget files, so an attacker would need elevated access. While a functional kernel crash can produce a denial‑of‑service, the risk is mitigated by the specialist permission model and low EPSS, making immediate patching the prudent action.