The esd_usb driver contained a use‑after‑free bug: after a device is disconnected, the driver frees the CAN netdev structures before killing the anchored USB request blocks (URBs). The freed private data is later accessed when unlinking the URBs, which can lead to a null or stray memory reference inside the kernel. Depending on the memory state, this flaw can be exploited to execute arbitrary code with kernel privileges or to trigger a kernel panic that causes a denial of service.

All Linux kernel installations that include the esd_usb driver in the “can” subsystem are affected. The vulnerability exists in every kernel build prior to the fix that reorders the teardown, regardless of the specific Linux distribution. Users of CAN over USB devices that rely on the esd_usb driver are impacted.

The CVSS score is not provided, and no EPSS value is available, but the flaw is a classic CWE‑416 use‑after‑free that introduces a kernel‑level attack surface. It is not listed in the CISA KEV catalog. The likely attack vector is the connection or disconnection of a malicious USB device that triggers the driver’s disconnect routine, or a software attack that forces the driver to unload. Because the flaw requires interacting with the USB subsystem, the risk is high for systems that accept user‑controlled USB devices.