The vulnerability involves a memory leak in the Linux kernel USB CDNSP subsystem; when cdnsp_alloc_stream_info() allocates a stream context array and a subsequent ring allocation or mapping update fails, the error path releases the ring structures but fails to free the stream context array, leaving allocated memory unreclaimed. Repeated failures can gradually consume kernel memory, potentially leading to a denial of service if the kernel runs out of available memory. The flaw is a classic memory leak.

The issue affects any Linux kernel that incorporates the CDNSP USB driver before the reported patch. No specific kernel versions are listed in the advisory, so all installations using the vulnerable code path may be impacted.

Based on the description, it is inferred that the EPSS score of <1% and its absence from CISA's KEV catalog indicate a very low likelihood of real-world exploitation. The flaw is local‑system in nature; an attacker would need trigger the failed stream allocation sequence, which typically requires interacting with the USB subsystem. There are no known public exploits, and the severity is considered low to moderate due to the indirect impact of a denial of service and the difficulty of triggering the error path.