CVE-2026-31723: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31723 is a denial-of-service vulnerability in the Linux kernel's USB gadget f_subset driver caused by improper net_device lifecycle management during bind/unbind cycles. When the USB gadget function unbinds, the parent gadget device is destroyed while the net_device survives, leaving dangling sysfs symlinks that corrupt the device tree. It affects Linux kernel versions from 3.11 up to (but not including) 6.12.81, 6.13–6.18.22, 6.19–6.19.12, and pre-release 7.0 release candidates. The vulnerability was published on May 1, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-763 (Release of Invalid Pointer or Reference): the net_device object retains a reference to a parent gadget device that has already been destroyed, resulting in dangling sysfs symlinks under /sys/class/net/ pointing to non-existent paths. The attack vector is local (AV:L) and requires only low privileges (PR:L), with no user interaction needed. The fix uses device_move() to reparent the net_device between the gadget device tree and /sys/devices/virtual across bind/unbind cycles — calling device_move(NULL) during final unbind moves the device to the virtual tree before the gadget is destroyed, and on rebind it is reparented back. A bound flag maintains compatibility with legacy composite drivers such as multi.c (Red Hat Bugzilla, Red Hat Advisory).

Successful exploitation results in a denial-of-service condition: a local low-privileged user can corrupt the sysfs device tree by triggering USB gadget unbind/rebind cycles, creating dangling symlinks that prevent proper device access and management. The impact is limited to availability (no confidentiality or integrity impact), and the scope is unchanged, meaning the effect is confined to the affected kernel subsystem. Systems using USB gadget networking (e.g., embedded Linux devices, Android-based systems with USB tethering) are most at risk (Red Hat Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Red Hat Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. Exploitation requires local access with low privileges, limiting the practical attack surface.

Update the Linux kernel to a patched version: 6.12.81 or later for the 6.12 stable branch, 6.18.22 or later for the 6.18 branch, 6.19.12 or later for the 6.19 branch, or kernel 7.0 (stable release) (Red Hat Advisory, Red Hat Bugzilla). As a workaround, restrict access to USB gadget function controls (e.g., ConfigFS interfaces) to trusted users only, reducing the risk of a low-privileged user triggering the bind/unbind cycle. Upstream kernel patches are available in the stable git tree at the commits referenced in the patch details.