The vulnerability resides in the Linux kernel’s USB ims-pcu driver, where CDC union descriptors are parsed without verifying that each descriptor’s bLength field is at least two bytes. An attacker can supply a descriptor with a bLength of zero, causing the driver to loop indefinitely. This infinite loop prevents the driver from proceeding and can hang the USB subsystem, potentially rendering the system unresponsive if the kernel does not recover. The attack does not provide direct code execution but can be used to disrupt services that rely on USB CDC devices.

The flaw is present in all Linux kernel builds that include the ims-pcu driver before the kernel patch commit that added the bLength check. No specific kernel release line is listed; the issue is vendor agnostic for Linux Kernel users. Consequently any system running an affected kernel version and utilizing the ims-pcu CDC union descriptor parsing is susceptible.

An EPSS score of < 1% indicates a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score is 5.5, but the infinite loop leads to a loss of availability and could be exploited by a malicious USB device connected to the system. The attack vector is likely physical or via compromised USB hubs; the exploitation prerequisites are the presence of a vulnerable kernel and a malicious device that can supply the malformed descriptor. Given the CVSS score of 5.5, the current risk is moderate, but the impact of a successful exploitation remains significant due to potential service disruption.