The vulnerability is a buffer size comparison flaw (CWE‑805) where the kernel incorrectly compares the bulk IN receive buffer length (ibuf_len) against the bulk OUT transmit buffer length (txbuf_len) instead of the actual receive buffer size. This causes an out‑of‑bounds write into kernel memory when a USB device sends a message longer than the real receive buffer, potentially leading to a denial of service or privilege escalation.

All Linux kernel implementations that include the legacy usbio probe path are potentially affected. The vendor is Linux, product is the Linux kernel, and no specific safe‑from list of versions is supplied, so any kernel containing the old usbio_bulk_msg code is susceptible until the mis‑check is corrected.

The vulnerability requires a malicious USB device to be physically attached to the target machine, making the attack local and device‑based. The CVSS score of 5.5 indicates a moderate severity. No public exploit code is known, but the EPSS score of < 1% indicates a very low but non‑zero exploitation probability. The KEV status is not listed, indicating it is not in CISA's Known Exploited Vulnerabilities catalog. An attacker with direct USB access could cause kernel memory corruption, leading to denial of service, crash, or, if leveraged, privilege escalation. This is a result of the buffer size comparison weakness (CWE‑805).