The function bos_descriptors_read() accesses USB device descriptor data while the containing usb_device structure can be freed concurrently by usb_reset_and_verify_device(); this lack of synchronization results in a use‑after‑free that can corrupt kernel memory and trigger a kernel OOPS. Based on the description, it is inferred that a local attacker who can manipulate USB devices could exploit this flaw, although privilege escalation is not confirmed.

All Linux kernel versions before the inclusion of the commit that adds a lock to bos_descriptors_read() are affected. The advisory does not list a specific version range, so any kernel prior to the patch should be treated as vulnerable.

Based on the description, it is inferred that a local attacker who can manipulate USB devices could exploit this flaw. The CVSS score of 7.8 indicates moderate to high severity, but the EPSS score of <1% shows a low probability of exploitation at the time of analysis. The vulnerability does not confirm privilege‑escalation capability, and the likely attack vector is local to the device.