The kernel bug prevents the USB xHCI controller from queuing new commands when the controller is marked unreachable during suspend or resume. Because the driver refuses to add commands to the ring while the hardware is inaccessible, USB devices become unresponsive and pending operations can stall the system, leading to a denial of service. The flaw is an improper handling of hardware state in the command queuing path documented as HCD_FLAG_HW_ACCESSIBLE.

Linux kernels implementing the xHCI driver are affected, with the issue present in all current releases until the patch that adds the guard against queuing when the hardware flag is cleared is applied. The specific affected kernel versions are not enumerated in the advisory, but the patch appears in the stable series of the Linux kernel. Users of any Linux distribution running a kernel that has not yet incorporated this fix are at risk.

The vulnerability has no publicly available exploits and no EPSS score, and it is not listed in the CISA KEV catalog. The assumption from the description is that an attacker must have local or elevated privileges to interact with the kernel device driver directly, making the attack vector local. The consequence is a denial of service, potentially disrupting USB device functionality. Although the impact is serious—system-wide USB interrupt may be blocked—the risk of exploitation is limited to environments where privileged access is feasible. The CVSS score is not provided, so the severity level must be inferred from the described denial of service effect.