CVE-2026-31723

Root

Cause

The Linux kernel's USB f_subset gadget function allocates a net_device during instance creation and registers it in sysfs with the gadget device as parent. When the gadget unbinds, the parent gadget device is destroyed, but the net_device is not reparented, leaving dangling sysfs symlinks. This was reported in the kernel stable commit series, where the fix uses device_move() to reparent the network device [1][2][3][4].

Exploitation

An attacker withMedium severity (CVSS 3.1 5.5) and low attack complexity, an attacker with physical USB access or ability to trigger gadget unbind (e.g., via hotplug) could cause repeated bind/unbind cycles. No authentication is required, as the attack relies on manipulating the USB gadget lifecycle, which is accessible from user space through sysfs or USB events [1].

Impact

After unbind, userspace utilities (e.g., ls /sys/class/net/usb0) follow a broken symlink to a non-existent path, potentially causing confusion, denial of service for network management tools, or incorrect state tracking. The dangling reference could also affect power management ordering, as the kernel expects a correct device tree hierarchy [1][2].

Mitigation

The fix has been backported to stable kernels via commits [1], [2], [3], and [4]. Users should update to kernels containing these commits. No workaround short of patching is available. The vulnerability is not listed as exploited in the wild (no KEV mention), but given the commonality of USB gadgets, updating is recommended.