When a user‑space process configures a FunctionFS gadget with only full‑speed descriptors while the kernel’s USB gadget operates at a higher speed, the kernel code attempts to read a descriptor that does not exist. The dereference of a null descriptor pointer causes an immediate kernel panic, abruptly terminating the system, and resulting in a local denial of service.

All Linux kernel builds that expose the FunctionFS interface are potentially affected, especially those configured to operate at high or super speeds without providing the corresponding descriptors. If the kernel version has not incorporated the recent commit that adds bounds checking and fallback logic, the system remains vulnerable. Distributions using the stock Linux kernel can be impacted unless they have applied the patch upstream or applied a backport.

The flaw is exploitable by local users who have the ability to configure USB gadget endpoints. Because the problematic code runs in kernel space, no elevated privileges beyond those required to perform gadget configuration are necessary. The CVSS score of 4.4 indicates a low severity. The EPSS score of less than 1% implies a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Despite these metrics, the kernel crash can still be leveraged by local attackers if the flaws remain unpatched. Updating the kernel to a version that includes the patch is the primary mitigation.