The ati_remote2 driver registers USB device attributes with the wrong context, causing the attribute callbacks to invoke to_usb_device on a usb_interface pointer. This type confusion produces an invalid usb_device pointer, which the kernel may dereference. If an attacker can manipulate the sysfs attributes exposed by the driver, the kernel could experience memory corruption, a crash, or potentially other adverse effects.

All Linux kernel installations using the ati_remote2 USB driver before the commit that added the fix (b20d6bf8014b and subsequent changes). The vulnerability affects any distribution that ships a kernel revision that includes the buggy driver implementation.

The vulnerability has a moderate CVSS score of 5.5 and an EPSS score of less than 1%, and it is not listed in CISA KEV. It is likely that exploitation would require local access to the affected USB device or the ability to write to the driver’s sysfs attributes. Based on the description, it is inferred that an attacker with such access could trigger the type confusion, leading to kernel memory corruption or a crash, but no confirmed remote code execution is documented.