The vulnerability resides in the Linux kernel’s USB core host controller driver (hcd). A missing check of flags passed to usb_submit_urb() when a root hub receives a control transfer can cause a deadlock between a device reset operation and a resume of the device. This deadlock freezes the kernel, interrupting all USB operations and effectively causing a denial of service. The weakness is an instance of improper handling of concurrent USB transaction logic (CWE-833).

The affected products are all Linux kernel distributions that include the legacy USB core code path together with the SCSI error handler and have not yet applied the commit that adds the deadlock protection. Because the kernel source is open, this includes any distribution that is still running a kernel older than the stable branch containing the fix. Specific affected versions cannot be listed because the data does not provide a version range; all kernels containing the legacy code are vulnerable.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, so no known active exploits are reported. Based on the description, it is inferred that an attacker would need to trigger a SCSI error-handling reset that performs a control transfer to a root hub, which typically requires local or device-level influence; thus it is a device-centric attack scenario. No exploitation evidence is in the public domain, and the likelihood of a successful attack remains low.