The Linux kernel’s USB CDC union descriptor parser performs a type confusion by trusting the bMasterInterface0 value from the descriptor without verifying that it matches the interface currently being probed. This flaw allows an attacker to overwrite the private data of another USB interface, potentially corrupting kernel memory and leading to system instability or a local privilege escalation. The vulnerability is a classic example of improper input validation that can corrupt critical driver data structures.

All versions of the Linux kernel are affected, as the CNA vendor list indicates Linux and there are no version restrictions provided. The issue is present in the generic USB CDC driver found in the kernel tree, affecting any machine that uses USB CDC devices such as modems, serial interfaces, or composite devices.

The CVSS score is 5.5, and the EPSS score is < 1%, so the exact severity is quantified. The vulnerability is not listed in CISA KEV, suggesting no widely known exploit at the time of publication. Exploitation would require local access to the target machine and the ability to present a crafted CDC union descriptor to the kernel, making the attack vector a local USB device connection. Given the kernel privilege level of the driver and the potential for memory corruption, the risk is considered high if local access is possible, but the lack of publicly documented exploits moderates the urgency slightly. Nonetheless, applying the latest kernel patch is recommended.