The bug occurs in the Linux kernel EHCI and FOTG210 USB host controller drivers when an isochronous transfer is submitted. If the controller becomes inaccessible or linking fails, an allocated isochronous schedule remains attached to the URB and is never freed. This represents a memory leak (CWE‑772) that also involves a use‑after‑free scenario (CWE‑416) when the code later frees a stale reference, potentially leaking kernel memory and contributing to resource exhaustion. Repeated failure of isochronous submissions can accumulate unrecovered kernel memory, eventually causing an out‑of‑memory condition or denial of service. No code execution or data disclosure is reported.

The issue is confined to Linux kernel implementations that include the EHCI or FOTG210 host controller logic. Based on the description, it is inferred that any kernel with EHCI or FOTG210 code and isochronous USB devices could be affected. The vulnerability is present in kernels up to at least version 7.1.1 and is not yet fixed in that version.

The CVSS score of 7.8 classifies the flaw as high severity, yet the EPSS score of less than 1% and its absence from the CISA KEV catalog indicate that public exploitation remains unlikely. The flaw is a purely internal kernel memory leak that requires an isochronous submission to fail; an attacker with local kernel privileges or a device that can trigger the failure would be needed to exploit it. No known exploit or external attack surface has been reported, so the overall risk stays low to moderate.