A use-after-free flaw exists in the Linux USB c67x00 driver when the final packet of an isochronous URB fails. The kernel returns the URB before updating scheduling state, freeing its private data, and the completion callback may release the URB reference. Subsequent accesses to the freed data can cause memory corruption and potentially allow an attacker to execute arbitrary code, crash the system, or cause other erratic behavior.

All Linux kernel releases that contain the c67x00 driver and lack the patch. The vulnerability affects the generic Linux kernel CPE identifier and applies to any system running a vulnerable kernel image, regardless of distribution or configuration.

The flaw is a classic use-after-free that can lead to arbitrary memory writes. Although no EPSS score is available and the issue is not listed in the CISA KEV catalog, the potential impact is high. Exploitation would likely require local or privilege-based access to trigger a USB isochronous transfer that exercises the vulnerable path, a scenario that is plausible for users with physical access to the machine or attackers who can control connected USB devices.