The vulnerability exists in the Linux kernel HID subsystem where the function to_usb_interface() is invoked without confirming that the HID device’s parent is a genuine USB interface. A uhid driver can fabricate a device that claims to be on BUS_USB yet has no USB parent. When the kernel processes such a device, the missing check triggers an illegal dereference leading to a kernel panic. This is a local flaw that results in a denial of service by crashing the host system.

All versions of the Linux kernel that include the ASUS HID driver before the patch adding the hid_is_usb() validation are affected. The issue is present in any deployment of the Linux kernel where the faulty HID code is compiled, including standard kernel builds, custom distributions, and kernel modules that interact with uhid devices. The specific version range is not listed, so any kernel prior to the commit mentioned in the advisory should be considered vulnerable.

Based on the CVE description, the likely attack vector involves a local user or process able to create a malicious HID device through the uhid subsystem. The missing parent check allows the kernel to dereference an invalid pointer when processing such a device, causing a kernel panic that results in a denial of service. The CVSS score is not provided, and the EPSS score is not available; the CVE is not listed in the CISA KEV catalog. Because the flaw requires local privilege to create a uhid device, the risk exposure is limited to systems where unprivileged users can load uhid or where uhid is enabled. There is no evidence that the kernel crash would lead to privilege escalation or other impacts beyond the service interruption.