The vulnerability arises in the Pegasus USB driver of the Linux kernel where pointer arithmetic is incorrectly used to access the usb_device_id table. When a dynamic ID is involved, the pointer arithmetic calculates an index that can be wildly out of bounds, a flaw classified as CWE-125, which can corrupt kernel memory. Such memory corruption can allow an attacker to gain elevated privileges or cause unexpected system behavior.

All builds of the Linux kernel that include the Pegasus USB driver are potentially affected. No specific kernel release or version range is listed, so existing installations of the kernel should be checked for a patch that addresses the pointer arithmetic bug.

As a moderate severity kernel memory corruption (CVSS 5.5), the vulnerability allows a malicious USB device or physically connected device to exploit pointer arithmetic in the Pegasus driver. During dynamic ID parsing, the index calculation can overflow the pointer range and corrupt reserved memory. If an attacker can trigger the condition, they may obtain elevated privileges or cause a denial of service. The EPSS score is less than 1%, indicating low current exploitation probability, and the vulnerability is not listed in CISA KEV. Still, the potential for local privilege escalation warrants remediation.