A race condition vulnerability in the Linux kernel USB MCTP subsystem allows local authenticated attackers to achieve high levels of system compromise.

This flaw is a race condition between USB Request Block (URB) completion and rx_retry cancellation in the MCTP network driver, requiring local low-privileged access with no user interaction.

A successful exploit of this race condition can lead to severe system instability, kernel panics, or complete system compromise through privilege escalation. Given the CVSS score of 7.8, this high-severity vulnerability poses a substantial risk to environments where untrusted local users have shell access, potentially resulting in unauthorized data access or denial of service.

Immediate Action: Update the Linux kernel to version 6.18.36, 7.0.13, or later where the race condition sequencing has been resolved.

Proactive Monitoring: Monitor system logs for unexpected kernel crashes, segmentation faults, or anomalous USB network driver behavior.

Compensating Controls: Restrict local shell access to trusted personnel only and enforce strict least-privilege principles to mitigate local attack vectors.

Public Exploit Available: false

Administrators must prioritize updating the Linux kernel across all vulnerable systems to patch the race condition in the USB MCTP driver. Applying the latest stable kernel builds is essential to prevent potential local privilege escalation and maintain system integrity.