The Linux kernel usbip VHCI host controller driver contains a flaw in the status_show_vhci() function: if platform_get_drvdata() returns NULL—such as when the driver probe fails due to USB bus number exhaustion—the code passes this NULL value to hcd_to_vhci_hcd(). That helper incorrectly returns a non‑NULL pointer offset, and subsequent dereferencing crashes the kernel. The result is a kernel panic that renders the host unresponsive, constituting a denial of service. The weakness is a classic NULL pointer dereference (CWE‑476).

All Linux kernel releases that have not yet incorporated the NULL‑check patch for usbip VHCI are affected. The vulnerability applies to any distribution shipping an unpatched kernel containing the vulnerable code, regardless of vendor or version, as long as the kernel’s usbip module is loaded.

The flaw requires the USB host controller probe to fail and the status_show_vhci() function to be invoked while the probe data is NULL. An attacker who can induce a probe failure or otherwise trigger the vulnerable path will cause a kernel panic. The CVSS score is 5.5, the EPSS score is under 1%, and the vulnerability is not listed in CISA’s KEV catalog. Because the exploitation results in a full kernel crash, the potential impact is severe, though the high conditionality of the exploit conditions limits likelihood to environments where the USB bus can be exhausted or the driver’s probe can be manipulated. Consequently the overall risk is considered high for affected systems that expose the usbip interface or run unpatched kernels.