In the Linux kernel’s USB gadget printer driver, the printer_read function mistakenly reuses the same variable for the requested copy size and the number of bytes actually copied into user space. copy_to_user returns the amount of data that could not be transferred; when no data is copied, the variable becomes zero. In that scenario, the loop control variables remain unchanged, and if more received data is available while the user buffer cannot be written, the read loop continues forever. This behavior results in a hang of the reading process, effectively denying service for any application attempting to read from the USB gadget printer device.

The flaw resides in the generic Linux kernel code, so any operating system distribution that ships with a kernel containing the buggy printer_read implementation is affected. Because the commit that fixes this issue was introduced in the mainline, all kernels prior to that patch are vulnerable. Users of binaries that rely on the USB gadget printer gadget—such as embedded Linux systems or devices exposing a virtual printer interface—are at risk when running an unpatched kernel.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of <1% suggests that exploitation is currently unlikely. Based on the description, it is inferred that a local user with permission to open the USB gadget printer device can trigger the flaw. The vulnerability can be triggered by repeatedly issuing read operations when the device’s receive buffer remains unwritable; this causes an infinite loop, consuming kernel resources and potentially rendering the process or the device unresponsive. The fact that the vulnerability is not listed in the CISA KEV catalog indicates no widely observed exploitation yet. The primary impact is denial of service for affected processes, which may worsen overall system responsiveness if many such processes accumulate.