Linux Kernel EUVD-2026-28735

The usbtmc driver implements the USB Test and Measurement Class protocol, used to communicate with laboratory and measurement instruments over USB. The driver exposes ioctl commands that allow user-space processes to configure and execute bulk USB transfers, including specifying timeout durations. Internally, these transfers were dispatched via usb_bulk_msg(), a kernel API that blocks the calling thread until completion or timeout - crucially, using an uninterruptible wait state (TASK_UNINTERRUPTIBLE). This means that if a user provides an extremely large timeout (e.g., INT_MAX milliseconds), the kernel thread is rendered unkillable for that duration, consuming a kernel execution context indefinitely. The fix replaces usb_bulk_msg() with usb_bulk_msg_killable(), which uses an interruptible wait (TASK_KILLABLE), allowing the kernel to respond to fatal signals. The affected CPE is cpe:2.3:a:linux:linux across a wide range of kernel versions. No CWE was assigned by the reporter, but the root cause class is most consistent with CWE-400 (Uncontrolled Resource Consumption) and CWE-835 (Loop with Unreachable Exit Condition) in an uninterruptible sleep context. The 'Information Disclosure' tag in the ENISA EUVD record appears to be a tagging error - CVSS confirms C:N/I:N/A:H, a pure availability impact with no confidentiality or integrity component.