The flaw resides in the Linux kernel’s dwc2 USB 2.0 controller driver. When the device is removed or encounters an error, the driver deletes the wake‑up timer only after the host controller state memory has been freed. Because the timer deletion is not synchronized with its callback, the timer can fire after the memory has been released, leading to a use‑after‑free (CWE‑416). In practice, this can crash the kernel and bring the system offline.

The vulnerability affects any Linux kernel that hosts the dwc2 driver for DesignWare USB 2.0 hardware and has not yet incorporated the upstream timer‑shutdown patch. All kernel versions running the dwc2 module prior to the fix are potentially impacted.

The base score is 4.7, and the EPSS score is reported as <1 %. The flaw is not listed in CISA’s KEV catalog, indicating no known active exploitation. Based on the description, the vulnerability requires local execution or elevated privileges to trigger the removal or re‑initialization of a USB host controller while the wake‑up timer is active. The risk is considered moderate; a successful exploit would cause a denial of service by crashing the kernel, while the possibility of privilege escalation is not confirmed but could be inferred from the use‑after‑free context. However, the low EPSS score suggests that successful exploitation is unlikely in the near term.