A high-severity use-after-free vulnerability in the Linux kernel USB dwc2 driver allows local authenticated attackers to achieve complete system compromise.

This flaw is a use-after-free vulnerability located in the USB dwc2 driver debug code, triggered when the driver improperly dereferences the urb pointer after calling usb_hcd_giveback_urb(). The attacker requires low privileges and local access with no user interaction.

A successful exploitation of this flaw can lead to a complete compromise of confidentiality, integrity, and availability of the affected host system. Because attackers can gain high privileges and execute arbitrary code in kernel space, organizations face risks of data theft, system disruption, and unauthorized lateral movement. The CVSS score of 7.8 indicates a high severity threat that demands prompt patching on affected hosts.

Immediate Action: Update the Linux kernel to version 5.10.259, 5.15.210, 6.1.176, 6.6.143, or apply the corresponding upstream fix commits.

Proactive Monitoring: Monitor system logs for kernel panics, segmentation faults, and suspicious process executions that may indicate exploitation attempts.

Compensating Controls: Restrict local shell access and implement strict least privilege principles to ensure that only authorized personnel can execute commands on vulnerable systems.

Public Exploit Available: No

Administrators must prioritize updating vulnerable Linux kernel packages across all affected infrastructure. Applying the provided stable kernel patches eliminates the underlying memory corruption vector and secures the host against local privilege escalation attempts.