The bug occurs in the Linux kernel EHCI and FOTG210 USB host controller drivers when an isochronous transfer is submitted. If the controller becomes inaccessible or linking fails, an allocated isochronous schedule remains attached to the URB. The resulting memory leak can accumulate kernel memory over repeated failures, eventually causing an out‑of‑memory condition or denial of service. No code execution or data disclosure is reported in the official description.

The issue is confined to Linux kernel implementations that include the EHCI or FOTG210 host controller logic. Based on the description, it is inferred that any kernel with EHCI or FOTG210 code and isochronous USB devices could be affected. The vulnerability is present in kernels up to at least version 7.1.1 and is not yet fixed in that version.

The EPSS score of less than 1% and the absence from the CISA KEV catalog suggest that public exploitation is unlikely. The flaw is a purely internal kernel memory‑leak and requires that a device driver attempt an isochronous submission that fails. An attacker would need local kernel privileges or a device that can trigger the failure to cause the leak. There is no known exploit or external attack surface, so the overall risk remains low to moderate.