The mcp2221 driver for the Linux kernel had a flaw that allowed a use‑after‑free during device teardown. Incoming HID reports could be read from freed memory, potentially causing an out‑of‑bounds memory access and a kernel panic. The result is a denial of service, rendering the host unavailable.

All Linux kernel builds that include the unpatched mcp2221 driver are affected. Every distribution shipping a kernel with that driver before the commit that stops device I/O may be vulnerable. The issue is tied to the driver code rather than a specific kernel version, so any kernel that uses the driver before the fix is impacted.

The CVSS score of 3.9 reflects low severity. The EPSS score of less than 1 % indicates a very low likelihood of exploitation, and the vulnerability is not listed in KEV. The attack vector requires local or device‑level access; an attacker would need to trigger a device removal or induce a probe failure on a system where the MCP2221 driver is loaded. Successful exploitation would lead to a kernel crash and reboot, but the scope is limited to the local system.