The bug involves incorrect usage of the dwc3_readl() and dwc3_writel() functions within the dwc3_ulpi_setup() routine of the Linux kernel's DWC3 USB controller driver. The code passed the register pointer (dwc->regs) instead of the expected dwc3 structure to these functions, raising compiler warnings and potentially causing the driver to access memory outside its intended address space. This misuse can corrupt kernel memory or trigger a kernel oops, resulting in a crash or unstable system behavior. The weakness is a type‑safety error (CWE‑843).

All Linux kernel builds that ship the DWC3 USB controller driver are affected. No specific kernel version is listed in the advisory, meaning any kernel revision prior to the fix that contains the fault should be considered vulnerable. The vulnerability does not apply to non‑kernel components; only systems that load the DWC3 driver for USB operation are impacted.

The EPSS score is reported as less than 1 % and the listing is not in the CISA KEV catalog, indicating a low public exploitation likelihood. No CVSS score is provided, so the severity cannot be quantified precisely. Based on the description, it is inferred that a local attacker with control over USB device inputs could trigger the faulty routine and force a kernel crash, but remote exploitation is not implied. The risk remains limited to a denial‑of‑service scenario unless the attacker can execute the code in the kernel context.