The vulnerability resides in the Linux kernel’s USB ULPI driver. When an early ULPI device registration fails, the driver forgets to free the allocated device name, causing a memory leak that is never reclaimed until a later successful registration or a system reboot. This unchecked consumption of kernel memory can gradually deplete RAM and degrade system availability, ultimately leading to a denial‑of‑service condition. The flaw is a classic example of improper resource management and a memory‑leak issue (CWE-401).

The defect is present in all unpatched Linux kernel builds that include the legacy ULPI driver. The CVE references list multiple kernel CPEs, covering the core Linux kernel. Consequently, any distribution running a kernel version that shipped before the patch—across all vendors—remains affected. No specific version range is currently documented, so administrators should consider all kernels older than the commit that introduces the early‑release fix as vulnerable.

Based on the CVSS core score of 5.5, this vulnerability is classified as moderate. The EPSS score of less than 1 % indicates a very low likelihood of current exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local hardware access: an attacker can repeatedly trigger ULPI registration failures—either by repeatedly plugging in defective USB devices, causing firmware errors, or by crafting a driver that forcefully initiates failed registrations—to accumulate memory pressure over time. While no active exploit is publicly documented, the gradual memory exhaustion can eventually cause the kernel to swap aggressively or abort processes, creating a denial‑of‑service situation. For systems that experience frequent USB disconnects or rely heavily on ULPI devices, the risk escalates, but for most workloads the practical risk remains low unless the failure condition is artificially repeated.