The esd_usb driver performs a use‑after‑free when a device disconnects: it frees each CAN netdev before killing the anchored USB request blocks (URBs). The freed private data is later accessed during URB unlinking, which can trigger an invalid memory reference in the kernel. Depending on the state of memory, this flaw can lead to a kernel panic (denial of service) or allow an attacker to execute arbitrary code with kernel privileges.

All Linux kernel builds that include the esd_usb driver in the "can" subsystem are affected. The issue exists in every kernel version prior to the commit that reorders the teardown sequence, regardless of distribution. Systems that support CAN over USB devices that rely on esd_usb are at risk.

The CVSS score of 7.8 indicates a high severity flaw, while the EPSS score of < 1% suggests a very low likelihood of real‑world exploitation as of now. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves the connection or abrupt disconnection of a malicious USB device that triggers the driver’s disconnect routine, or a software action that forces the driver to unload. The flaw requires user‑controlled USB hardware interaction, making it more relevant for servers and devices that accept external USB peripherals.