Linux Kernel EUVD-2026-28731

The vulnerability is in the mdc800 USB driver (drivers/usb/image/mdc800.c), which handles Mustek MDC-800 series USB digital cameras. The mdc800_device_read() function submits a download_urb and blocks using wait_event_timeout(). The defect is that the return value of wait_event_timeout() is not evaluated: if it returns 0 (timeout elapsed with no completion), the function exits without calling usb_kill_urb() to cancel the pending transfer. When a subsequent read() call arrives, usb_submit_urb() is invoked on the same URB that is still in-flight, violating the USB core invariant and triggering the kernel safety warning 'URB submitted while active', which can cause a kernel oops or panic (Availability: High per CVSS). CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H confirms the impact is limited to local availability with no confidentiality or integrity consequences - the 'Information Disclosure' tag in the source data does not align with this vector and appears to be a misclassification. This class of bug is analogous to resolved issues in the yurex driver (commit 372c93131998) and iguanair driver (commit b98d5000c505). No CWE was formally assigned, but the root cause maps closely to CWE-404 (Improper Resource Shutdown or Release) and CWE-362 (Race Condition) on timeout paths.