The Linux kernel contains a flaw in the huawei HID driver where to_usb_interface() is invoked without first verifying that the device’s parent is actually USB. A user‑space HID interface can fabricate a device that reports itself on BUS_USB yet has no real USB parent. When the driver processes such a device, the unchecked conversion causes a kernel exception and a system crash (splat).

The vulnerability is listed only for Linux:Linux, indicating that any Linux kernel that has not applied the mitigating commit is potentially affected. No specific version numbers are supplied, so all kernel releases prior to the patch that added an hid_is_usb() check are at risk.

The EPSS score is not available and the issue is not catalogued in CISA KEV, but a kernel crash is a critical denial‑of‑service condition. The missing check can be triggered locally by creating a fake USB‑identified HID device via the uhid interface, which normally requires elevated privileges. Therefore the risk is moderate to high for systems that allow non‑privileged user space programs to instantiate HID devices. The absence of a public exploit does not eliminate the possibility of exploitation, and the vulnerability’s severity is limited only by the attacker’s ability to invoke the fault.