The flaw comes from a race condition between the usb_del_gadget() routine, which frees the UDC structure, and gadget_match_driver(), which accesses that same structure concurrently. When the UDC memory is freed while gadget_match_driver() continues to read it, the freed memory is zeroed and a NULL pointer dereference occurs, causing a kernel panic. Kernel logs show the crash as the null pointer dereference at virtual address 0x0000000000000000.

All versions of the Linux kernel that enable the USB gadget subsystem are susceptible until the kernel code is updated to include the usb_gadget_release() routine that prevents the UDC structure from being freed prematurely.

The CVSS score of 5.5 indicates a moderate severity, and the EPSS score of less than 1% reflects a very low probability of real‑world exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local or privileged access that allows an attacker to manipulate the USB gadget configuration via configfs while a gadget is being removed, creating the race between usb_del_gadget() and gadget_match_driver(). Thus, the attack vector is limited to environments where such access is possible, and the risk is moderate but constrained to that scenario.