The Linux kernel’s usb_disable_endpoint() function improperly clears only one of the dev->ep_in[epnum] or dev->ep_out[epnum] entries for non‑zero control endpoints based on the endpoint direction. This leaves the opposite entry pointing to a freed usb_host_endpoint structure, which can lead to a use‑after‑free condition. An attacker who can supply a malicious USB device with a non‑zero control endpoint can trigger this dangling pointer and potentially perform arbitrary writes in kernel space, leading to memory corruption and privilege escalation. This is a form of improper error handling (CWE‑825).

Any Linux kernel release that contains the original usb_disable_endpoint implementation without the fix is vulnerable. The issue was demonstrated against kernel 7.3.0‑rc3, so all kernels prior to the inclusion of the patch that clears both dev->ep_in[epnum] and dev->ep_out[epnum] for non‑ep0 control endpoints remain affected. Distributions shipping kernels older than the fix, or those that have not backported the change, are at risk.

The CVSS score of 6.2 indicates moderate severity, and the EPSS score of <1% suggests a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Because the flaw is triggered during USB device enumeration, the attack remains local and requires access to a USB device that forces enumeration of a non‑zero control endpoint. Successful exploitation could lead to kernel memory corruption, denial of service, or privilege escalation, but would require a crafted device and local interaction.