The Linux kernel bug prevents the USB xHCI controller from queuing new commands when the controller is marked inaccessible during suspend or resume. Because the driver refuses to add commands to the ring while the hardware is inaccessible, USB devices become unresponsive and pending operations can stall the system, potentially leading to a denial of service. The flaw manifests as improper handling of the HCD_FLAG_HW_ACCESSIBLE state and is mitigated by a patch that stops queuing in that scenario while issuing a warning if suspending with pending commands.

Linux kernels that implement the xHCI driver are affected. When the xHCI controller is marked inaccessible during suspend or resume, the driver refuses to queue new USB commands. Specific version details are not provided in the CVE data, so any kernel running the vulnerable code before the patch is at risk. Users of Linux distributions with a kernel that has not incorporated this fix remain vulnerable.

The EPSS score is reported as less than 1%, indicating a very low exploitation probability. The vulnerability is not listed in CISA KEV. Interaction with the kernel driver is required, so the attack vector is likely local or requires elevated privileges. The CVSS score of 5.5 reflects medium severity, meaning the risk of exploitation is moderate, but the potential impact is significant in environments where the attacker can influence USB activity or suspend state.