This vulnerability occurs in the Linux kernel's UVC video driver. If an asynchronous UVC control is active, the function uvc_status_stop can be invoked from the async_ctrl.work workqueue. The routine calls cancel_work_sync, which waits for the work function to finish. Because the same work function is awaiting its own completion, a deadlock is created, causing the UVC subsystem to halt and potentially freeze device operations. The flaw is a classic concurrency issue that can disrupt camera functionality and lead to a denial‑of‑service for the device.

The defect affects all versions of the Linux kernel that contain the buggy configuration of the UVC driver and are prior to the commit that introduces the early‑return guard. It applies to any distribution using those kernel releases, as the CPE string indicates the base Linux kernel.

The CVSS score of 5.5 indicates a moderate severity, while the EPSS score of less than 1% suggests a very low but nonzero likelihood of exploitation. The vulnerability is not listed in CISA KEV and no public exploit has been reported. An attacker would require access to a UVC camera with asynchronous control, so the risk largely applies to devices or users that operate such cameras. The deadlock can result in a denial‑of‑service to camera applications until the system or the camera is reset.