CVE-2026-31724

Vulnerability

Description

In the Linux kernel's USB Ethernet Emulation Model (f_eem) gadget driver, the net_device is allocated during function instance creation and registered with the gadget device as its sysfs parent during bind. However, when the function unbinds, the parent gadget device is destroyed while the net_device remains, leading to dangling sysfs symlinks. This results in inconsistent sysfs topology, as the symlink in /sys/class/net/usb0 points to a non-existent path [1].

Exploitation

An attacker with the ability to trigger USB gadget bind/unbind cycles (e.g., by physically connecting/disconnecting a USB device or via sysfs interactions) can cause the dangling sysfs entry. No special privileges are required beyond access to trigger unbind operations, which may be available to local users or via automated USB events.

Impact

The dangling sysfs symlink can lead to denial of service (DoS) when users or tools attempt to access the network device via sysfs, encountering "No such file or directory" errors. Additionally, improper power management ordering may occur due to the broken parent relationship. The vulnerability does not directly enable code execution but degrades system reliability.

Mitigation

The fix introduces device_move() to reparent the net_device between the gadget device tree and /sys/devices/virtual across bind and unbind cycles, ensuring proper sysfs cleanup. Patches have been applied to stable kernel branches [1]. Users should update to the latest patched kernel version.