CVE-2026-31721

The vulnerability resides in the Linux kernel's USB f_hid gadget driver. When a HID gadget is bound and a user opens /dev/hidg0, the driver initializes wait queues and other data structures in the hidg_bind function. If the UDC is then unbound and rebound while the file descriptor remains open and is used with epoll, the bind function re-initializes the wait queues while they still contain entries, leading to a list_del corruption when the epoll file descriptor is later removed [1].

Exploitation requires a specific sequence: setup and bind a HID gadget, open /dev/hidg0, add the fd to an epoll instance (EPOLL_CTL_ADD), unbind the UDC, bind the UDC again, and then attempt to remove the fd from epoll (EPOLL_CTL_DEL). This sequence triggers the corruption, which is detectable when CONFIG_DEBUG_LIST is enabled, but may cause memory corruption in production kernels.

The impact is a kernel list corruption that can lead to a system crash or potentially exploitable memory corruption. An attacker with local access and the ability to control USB gadget binding and unbinding could trigger this condition, though the attack surface is limited to systems using the USB gadget subsystem with HID functions.

The fix, committed in the Linux kernel stable tree, moves the initialization of wait queues and other data structures from hidg_bind to hidg_alloc, ensuring they are initialized once per function instance and not re-initialized while in use [1]. Users should update to a patched kernel version containing this commit.