The vulnerability is a race condition that can trigger a use‑after‑free (CWE‑416) and a subsequent null pointer dereference (CWE‑476) when a USB gadget device is removed while its configuration is being altered via configfs. The UDC structure freed by usb_del_gadget() is zeroed, causing the kernel to dereference a null address, which results in a fatal kernel panic. The impact is a local denial of service, and based on the description, it is inferred that an attacker could potentially exploit the crash to achieve privilege escalation by manipulating the configuration during the removal process.

All current Linux kernel releases that incorporate the USB gadget subsystem are affected until the code introducing usb_gadget_release() is applied. In particular, the version strings listed in the CPE data (Linux kernel 7.2 release candidates 1 and 2 as well as the generic kernel *) are known to contain the vulnerable code. Any distribution that ships with the same kernel source tree without the patch is vulnerable.

The CVSS score of 7.8 indicates high severity, but the EPSS score of less than 1% suggests a very low probability of real‑world exploitation. Based on the description, it is inferred that an attacker must have access to the USB gadget configuration via configfs while the device is being disconnected, effectively requiring local or privileged access. The vulnerability is not listed in the CISA KEV catalog, and exploitation would need the race condition to be triggered successfully against the vulnerable kernel release. The attack vector is therefore limited to environments where such access is possible, and the risk remains high but constrained to that scenario.