A deadlock in the Linux kernel’s USB gadget function f_tcm creates a circular lock dependency that can cause the system to suspend or lock up. The vulnerability arises when dep_lock is held while calling configfs_depend_item_unlocked, which in turn acquires the configfs root inode lock, forming a cycle with su_mutex. The effect is a halt or severe performance degradation for processes that interact with the USB gadget stack, potentially disrupting services that rely on USB communication. This is a typical race condition leading to system instability, described by CWE‑830.

All Linux kernel deployments that include the f_tcm USB gadget driver are affected, as the issue exists in the general Linux kernel and is not limited to a single distribution or version. The fix is implemented via a kernel commit (reference commit 3639438a4c83ffc2e564c8c010b92137c5d11cfa), but the specific kernel package or release that integrates this commit is not identified in the advisory. Users of any Linux kernel build that incorporates the f_tcm driver should check for this commit or later versions.

The CVSS score is not provided, and no EPSS score is available, so the exact severity cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation. The attack vector appears to come from control over USB gadget operations; a malicious payload could trigger the deadlock by interacting with the device driver. Since the issue causes a deadlock rather than direct code execution, the risk is primarily to availability rather than confidentiality or integrity.