The Linux kernel gadget f_tcm driver contains a race condition that allows a session to be removed while the last logical unit number (LUN) is still being torn down. This condition can free a session structure that is still in use by an active command, leading to a use‑after‑free and an ensuing kernel crash or oops. An attacker controlling a USB gadget device could trigger this scenario, causing the target system to become unstable or to reject privileged operations. The immediate impact is a denial of service, and the crash could potentially be leveraged for local privilege escalation if additional vulnerabilities are present.

The flaw affects all Linux kernel versions that include the f_tcm gadget driver prior to the patch in the referenced commits. Any system that loads the usb gadget f_tcm driver—commonly used for USB storage, Fibre Channel target emulation, or other device emulation—remains vulnerable. The vulnerability is not tied to a specific vendor beyond the Linux kernel distributed by Canonical, Red Hat, SUSE, and others.

No CVSS score is supplied, and EPSS is not available, so the quantitative risk cannot be precisely quantified. The flaw is not listed in CISA's KEV catalog, suggesting it has not yet been publicly exploited. However, because the vulnerability triggers a kernel crash and may be exercised by a local attacker or anyone who can control a USB gadget connection, the risk remains significant for devices that require high availability. The attack vector is likely local, involving the insertion of a USB gadget device that leverages f_tcm; remote exploitation would require the attacker to have physical or privileged access to the target machine.