CVE-2026-31726: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31726 is a NULL pointer dereference vulnerability in the Linux kernel's USB gadget UVC (USB Video Class) driver that can be triggered during a race condition between the unbind path and power management (PM) transitions. The flaw was introduced by commit b81ac4395bbe, which used a timing-based synchronization approach (1500ms wait) in uvc_function_unbind() that is insufficient when the PM subsystem aborts wait_event_interruptible_timeout() early during suspend. Affected kernel versions include 5.10.117–5.10.252, 5.15.41–5.15.202, 5.18–6.1.167, 6.2–6.6.133, 6.7–6.12.80, 6.13–6.18.21, 6.19–6.19.11, and Linux 7.0 release candidates. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Red Hat Bugzilla).

The root cause is a Time-of-Check Time-of-Use (TOCTOU) race condition (CWE-367) combined with a NULL pointer dereference (CWE-476) in the uvc_function_unbind() path of the USB gadget UVC driver. When the PM subsystem begins freezing user-space processes during suspend, it aborts the interruptible wait in the unbind thread, allowing it to proceed and set cdev->gadget = NULL. Upon resume, when tasks restart and the V4L2 release path executes uvc_v4l2_release() → uvc_function_disconnect() → usb_function_deactivate() → usb_gadget_deactivate(), it dereferences the now-null gadget pointer at virtual address 0x0000000000000030, triggering a kernel panic. The fix introduces a func_unbound flag protected by a new mutex (uvc->lock) for safe state checking, and uses a completion primitive to synchronize uvc_function_unbind() with uvc_vdev_release() to prevent use-after-free (Red Hat Bugzilla).

Successful exploitation causes a kernel panic (NULL pointer dereference), resulting in a complete denial of service on the affected system. The impact is limited to availability — there is no confidentiality or integrity impact. Only systems that combine USB gadget UVC functionality with active power management (suspend/resume cycles) are affected, limiting the scope to embedded devices, single-board computers, or Linux systems acting as USB video gadgets (Red Hat CVE, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires local access with low privileges and the ability to trigger power management transitions (e.g., suspend/resume) on a system with USB video gadget functionality enabled. The EPSS score is 0.024% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Red Hat CVE).

• Logs: Kernel log entries showing Unable to handle kernel NULL pointer dereference at virtual address 0000000000000030 following a suspend/resume cycle on a system with USB gadget UVC enabled.
• Logs: Call trace in kernel logs referencing usb_gadget_deactivate, usb_function_deactivate, uvc_function_disconnect, uvc_v4l2_release, and v4l2_release.
• Logs: Messages such as uvc: uvc_function_unbind no clean disconnect, wait for release immediately preceding a kernel panic during PM transitions.

Apply kernel updates to the patched stable releases: 5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, or later. Linux 7.0 release candidates after the fix commit are also addressed. As a temporary workaround where patching is not immediately feasible, disabling power management suspend/resume transitions on systems using USB gadget UVC functionality can prevent the race condition from being triggered. Prioritize patching on embedded or IoT devices that use the UVC gadget driver and undergo frequent suspend/resume cycles (Red Hat CVE, Red Hat Bugzilla).