The Linux kernel’s dummy-hcd driver incorrectly waits for a completion counter to reach zero during emulate_synchronize_irq(). The counter is increased for gadget driver callbacks but not for request completion callbacks, so the driver’s unbind routine can run while outstanding request completions are still pending. The gadget module may be unloaded while a completion handler is executing, leading to a race condition that can cause kernel instability, crashes, or memory corruption due to use‑after‑free.

The vulnerability affects all Linux kernel releases that include the dummy-hcd driver without the recent patch. Any system that loads a gadget driver via dummy‑hcd, such as for USB simulation or testing, is potentially exposed. The fix was introduced by commit 3070806a7bc7bb36ed04a21022c09dafcc5619f4 and later commits, so older kernel versions remain vulnerable while newer ones include the change. Linux is the sole affected vendor; no other vendors or sub‑products are listed.

The EPSS score is < 1% and the issue is not listed in the CISA KEV catalog, so public exploitation data is limited. The CVSS score is 4.1, but the potential for a kernel panic indicates a high impact. Exploitation would require the dummy‑hcd driver to be loaded and a request completion to occur during an unbind, so an attacker needs advanced knowledge of the target’s USB gadget configuration or local/privileged access. Even without discovered exploits, the risk is elevated for environments that rely on dummy‑hcd for development or testing. The lack of publicly available exploit code does not preclude future targeted attacks.