The vulnerability exists in the Linux kernel USB SR9700 driver, where the code incorrectly checks the packet length after subtracting the Ethernet CRC. It compares the payload length against the entire remaining receive buffer instead of ensuring the payload fits after the SR_RX_OVERHEAD. This unchecked length could lead to an out‑of‑bounds copy and corruption of kernel memory, potentially allowing privilege escalation or a denial‑of‑service condition. The flaw is purely a bounds‑check error, which can be exploited when malicious USB traffic is processed by an affected system.

The issue affects all Linux kernel builds that include the SR9700 USB driver. The affected package is the generic Linux kernel, all versions that have previously shipped this driver implementation. No specific version range is supplied, so the entire kernel codebase containing the SR9700 driver is at risk until the issue is patched.

The CVSS score is 6.5 and the EPSS score is < 1%. The CVSS score of 6.5 indicates moderate severity, and a very low probability of exploitation is reflected by the EPSS score. The vulnerability is not listed in CISA's KEV catalog, meaning no known widespread exploitation. Because the flaw involves an unvalidated buffer copy in the kernel, it carries a realistic risk if an adversary can inject malicious USB traffic, though no public exploit has been identified yet.