The vulnerability occurs in the Linux kernel’s USB gadget OTG composite driver. The code assumes that the configuration list will never be empty, but when it is, the list_first_entry function returns the list head instead of a valid configuration. This leads the code to read from an unexpected offset in the usb_composite_dev structure; accessing config->descriptors[0] therefore triggers an out-of-bounds read into the response buffer sent to a USB host. The result can expose kernel memory contents to a local attacker, representing a potential local information disclosure.

Any Linux kernel build that includes the OTG composite driver is affected. No specific version numbers are listed, so the flaw may exist in any kernel revision that has not incorporated the patch described in the advisory commit history.

The CVSS score of 5.5 indicates a medium-level severity. The EPSS score is less than 1 % and the vulnerability is not listed in CISA KEV, indicating a low probability of exploitation in the wild. Based on the description, it is inferred that the attacker would need local or privileged access to load a malicious USB gadget driver or to trigger a race condition during gadget teardown, a scenario that is highly constrained. The vulnerability does not provide remote code execution and the primary impact is limited to a local kernel memory read.