This vulnerability is a memory leak in the Linux kernel’s USB gadget f_fs driver caused by an orphaned reference to a DMA fence that is never released. Each USB request that creates a DMA fence leaves an unrecruited reference, causing the kernel to gradually consume more memory. Over time the kernel can exhaust available memory, leading to a denial of service or forced reboot.

All Linux kernel releases prior to the patch commit 0cae3d6109427c455bad0a18dfb3e2a91657e38a are affected. The flaw resides in the f_fs component of the kernel’s USB gadget subsystem, so any system that supports USB gadgets and has the f_fs driver enabled is vulnerable. Most mainstream distributions shipping recent kernels without this update are at risk.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% suggests that active exploitation is unlikely at present. The flaw is not listed in the CISA KEV catalog. An attacker would need to trigger repeated USB gadget transfers that allocate DMA fences, a scenario that could be engineered by a malicious USB device or a misconfigured gadget. The impact remains significant because a sustained leak can drain kernel memory and force a reboot, even though exploitation vectors in the wild are not widely reported.