The Linux kernel driver "xusbatm" incorrectly assumes that the USB device ID table is array‑indexed, performing pointer arithmetic on an address that can be allocated on the heap when a dynamic ID is used. This miscalculation can produce a wildly out‑of‑bounds index, allowing an attacker to read or write arbitrary kernel memory through a malformed USB device. The flaw is a classic out‑of‑bounds pointer misuse and can lead to denial‑of‑service or privilege escalation if the attacker owns the USB host.

All Linux kernel releases that contain the unpatched xusbatm driver. The fault is present in every kernel version that applies the original driver code; a fix was applied in commit 8944ef1 and subsequent releases. The exact minimum version is not specified, so any kernel before the patch is considered vulnerable.

The vulnerability has no publicly available exploit code and is not listed in the CISA KEV catalog, and its EPSS score is < 1%. The CVSS score of 5.5 indicates a medium‑severity vulnerability. Nevertheless, because the flaw allows an attacker with control over the USB host to manipulate kernel memory, the potential impact is significant. Attack requires physical or locally connected USB hardware; it cannot be triggered over the network. Given the nature of the bug, it should be treated as a moderate kernel exploit until confirmed mitigation status is established.