The ems_usb driver in the Linux kernel does not verify that the length declared for each CPC message fits within the USB receive buffer. A malicious USB device that sends messages with declared lengths larger than the actual payload can cause a buffer overrun or under‑read during ems_usb_read_bulk_callback(). This unchecked input may result in kernel memory corruption, leading to a system crash, denial of service, or if an attacker can precisely control the write pattern, potentially arbitrary code execution with kernel privileges.

Affected releases are not enumerated in the advisory, but any system that loads the ems_usb driver and connects a USB CAN interface is vulnerable. The driver is part of the Linux kernel; therefore, stock kernel distributions that include the driver and the unpatched ems_usb subsystem are at risk until the patch is applied.

The CVSS score is 5.5. The EPSS score is < 1%, indicating a low probability of exploitation. The vulnerability is not listed in CISA KEV, suggesting no confirmed exploitation in the wild. However, the likely attack vector is a malicious USB device connected to the host, and the defender can trigger the bug from the USB bus, keeping the risk substantial for exposed systems.