The vulnerability originates from the Linux kernel's USB ULPI driver, where an allocated device name is never freed when early device registration fails, causing a memory leak. Each failed attempt retains a reference to the device structure, leading to progressive memory consumption that can eventually exhaust system memory and degrade availability. The flaw is an instance of improper resource management (CWE-772).

The defect exists in the upstream Linux kernel and affects all vendors that ship a kernel containing the unpatched ULPI driver. No specific vendor or version range is listed, so any Linux distribution running the affected kernel warrants review. The advisory does not provide explicit version details, but the change targets the core ULPI subsystem implemented in the mainline kernel.

The EPSS score is listed as less than 1%, indicating a very low probability of exploitation, and the vulnerability is not included in CISA's KEV catalog. Based on the description, the likely attack vector is local; an attacker would need to trigger repeated ULPI device registration failures—from either local hardware access or software that forces such registrations—to consume memory. Although no public exploit exists, the risk is moderate because the flaw can gradually degrade system responsiveness, especially in environments with frequent USB device plug‑in or disruption events.