The Linux kernel contained a race condition in the USB serial subsystem that could allow a concurrent write to the "new_id" attribute while a driver is being deregistered. This race could result in the dynamic identifier remaining allocated or leaking a previously used ID, exposing information about devices that should no longer be visible. The flaw does not directly grant code execution, but it could enable an attacker to infer device enumeration or persistence of USB device identifiers after driver removal, potentially aiding other attacks.

The issue affected all Linux kernel releases that include the USB serial driver before the patch commit. Both generic Linux distributions and any system running the standard kernel with USB serial support are potentially vulnerable. The exact version numbers are not specified in the advisory, so any pre‑fix kernel should be considered at risk.

The advisory does not provide an EPSS score or KEV listing, indicating a low publicly known exploitation probability at the time of this report. The race condition requires specific timing and kernel state, making malicious exploitation difficult but not impossible without kernel code execution. Until the fix is applied, the safest course is to treat this as a low‑to‑medium severity risk that can lead to information leakage. Applying the patch removes the race.