Linux Kernel CVE-2026-53107

Exploitation requires all of the following: (1) a Marvell Libertas chipset-based USB WiFi adapter physically connected to the target system, (2) the libertas_usb kernel module loaded and active, (3) local access with at minimum low-privilege user permissions (PR:L per CVSS), and (4) the specific race condition where the HCD giveback interrupt fires during an active usb_tx_block() call - a timing-dependent condition inherent to the driver's normal operation under WiFi load. Systems without the Marvell Libertas USB adapter hardware are completely unaffected regardless of kernel version. Remote exploitation is not possible (AV:L). Root or administrator privileges are not required, but the attacker must be able to generate or influence WiFi TX traffic on the device.

The NVD CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) accurately reflects the narrow risk profile: local access with low privileges, no confidentiality or integrity impact, and scope limited to the vulnerable system. EPSS at 0.15% (5th percentile) is consistent with a kernel driver bug requiring specific legacy hardware - the probability of observed exploitation in the next 30 days is extremely low. The vulnerability is not listed in CISA KEV and no public POC is known. The 'Information Disclosure' tag in the source data appears to be a misclassification; the CVSS vector (C:N/I:N/A:H) and description confirm this is purely a denial-of-service / kernel crash issue. Real-world risk is further constrained by the requirement for a Marvell Libertas USB WiFi adapter to be physically present and the driver loaded - a niche hardware configuration largely absent from enterprise and cloud environments. This is a genuine kernel stability bug warranting patching on affected embedded or legacy systems, but it is not a prioritized threat for most organizations.

A local user with standard (non-root) privileges on a system equipped with a Marvell Libertas USB WiFi adapter generates rapid WiFi TX traffic, triggering the HCD giveback interrupt at a moment when usb_tx_block() is executing. The sleeping usb_kill_urb() call executes in interrupt context, triggering a kernel BUG() or scheduler deadlock that crashes the system. No public proof-of-concept exploit is available at time of analysis, and the race window is hardware- and timing-dependent.