The flaw arises in the USBIO subsystem when the device teardown walks the client list in reverse. A freed client can be dereferenced during iteration, triggering a use‑after‑free that KASAN reports. This kernel bug falls under CWE‑825 and can lead to a crash or unintended code execution within the kernel context.

The vulnerability affects Linux kernel implementations that have not yet incorporated the commit that changes usbio_disconnect to use list_for_each_entry_safe_reverse. Without a specific version list, all kernels older than the patch appearance in commit 1947b6411460d68b54b13c536961933166937d05 are potentially vulnerable.

The CVSS score for this vulnerability is 5.5, indicating moderate severity, but because it is a kernel use‑after‑free, exploitation could lead to a crash or privilege escalation. The EPSS score is below 1 % and the flaw is not listed in CISA KEV, indicating a low current exploitation probability. However, the severity of a kernel failure is high. The likely attack vector is local, involving interaction with USB devices, and the vulnerability is clearly documented by the reported KASAN use‑after‑free and stack traces.