The Linux kernel’s USB core module lacked proper synchronization in usb_wakeup_notification(), allowing a race condition with hub_disconnect(). By manipulating USB traffic the attacker can force the function to access memory that has already been freed, leading to a use‑after‑free that can crash the kernel or, with sufficient privilege, provide a foothold for arbitrary code execution at the kernel level.

Linux kernel builds that have not yet incorporated the lock added in the commit identified by 04ab260 are vulnerable. This includes most mainstream distributions still shipping the older kernel. The fix is present in mainline and downstream kernels that have applied the patch.

CVSS and EPSS data are not available, but use‑after‑free in the kernel is high‑severity. Exploitation requires local control of USB traffic or the ability to trigger the timing race, making remote exploitation unlikely without privileged access or malicious hardware. The flaw is not listed in KEV, indicating no widely known active exploits yet.