In the Linux kernel’s dummy_hcd USB gadget driver, a race condition allows a single shared usb_request object (fifo_req) to be overwritten while its completion callback is still executing. The driver’s fast‑path reuses a single fifo_req slot for small IN transfers. During the giveback phase the request’s queue pointer is cleared before the completion routine returns, letting a concurrent queue operation on another CPU reuse fifo_req and overwrite its callback function pointer with data from a new request. When the kernel later attempts to invoke the overwritten callback, it jumps to a corrupted pointer, causing a general protection fault that brings the system down. The fix introduces a busy flag that protects the fifo_req slot until the completion callback has fully returned, preventing reuse during that window. The flaw is identified as CWE‑821.

The flaw resides in the Linux kernel’s dummy_hcd module, part of the USB gadget framework used mainly for emulation and testing. All Linux kernel builds that include dummy_hcd are potentially affected; no particular version range was supplied. The vulnerability does not rely on a particular kernel configuration beyond the inclusion of the dummy_hcd driver.

The EPSS score of < 1% indicates that the likelihood of exploitation is very low. The flaw’s impact is severe because it causes a kernel crash that can lead to a denial‑of‑service. The CVSS score of 7.8 reflects this high severity. Since the flaw is not listed in the CISA KEV catalog, active exploitation may not yet be widespread. Exploitation would involve orchestrating concurrent gadget requests to trigger the race condition, and it likely requires local or privileged control over the USB gadget layer. The mitigation—preventing reuse of the shared fifo_req until completion—reduces the attack surface but does not eliminate the need for patching.