The Linux kernel contained a race condition in the USB serial subsystem that could allow a concurrent write to the "new_id" attribute while a driver is being deregistered. This race could leave a dynamic identifier allocated or leak a previously used ID, exposing information about USB devices that should no longer be visible. The flaw does not directly grant code execution, but it could enable an attacker to infer device enumeration or persistence of USB device identifiers after driver removal, potentially aiding other attacks.

The issue affected all Linux kernel releases that include the USB serial driver before the patch commit. Both generic Linux distributions and any system running the standard kernel with USB serial support are potentially vulnerable. The exact version numbers are not specified in the advisory, so any pre‑fix kernel should be considered at risk.

The CVSS score for this vulnerability is 1.9, indicating low severity. The EPSS score is <1%, and the vulnerability is not listed in the CISA KEV catalog, indicating a low publicly known exploitation probability. The race condition requires specific timing and kernel state, making malicious exploitation difficult but not impossible without kernel code execution. Until the fix is applied, the safest course is to treat this as a low‑to‑medium severity risk that can lead to information leakage. Applying the patch removes the race.