CVE-2026-31756: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31756 is a spin lock/unlock mismatch vulnerability in the Linux kernel's dwc2 USB gadget driver, specifically within the dwc2_hsotg_udc_stop() function. The flaw was published on May 1, 2026, and affects multiple stable Linux kernel branches including versions 5.15.187–5.15.202, 6.1.143–6.1.167, 6.6.96–6.6.133, 6.12.36–6.12.80, 6.15.5–6.18.21, 6.19.x before 6.19.12, and Linux 7.0 release candidates. It carries a CVSS v3.1 base score of 5.5 (Medium), exploitable locally by a low-privileged user with no user interaction required (GitHub Advisory, Red Hat Bugzilla).

The root cause is improper locking (CWE-667) combined with an unlock of a resource that is not locked (CWE-832). The dwc2_gadget_exit_clock_gating() function internally invokes the call_gadget() macro, which expects hsotg->lock to be held — it performs a spin_unlock/spin_lock pair around the gadget driver callback. However, dwc2_hsotg_udc_stop() calls dwc2_gadget_exit_clock_gating() without first acquiring the lock, resulting in two distinct failure modes: (1) spin_unlock is called on a lock that is not held, causing undefined behavior; and (2) the lock remains held after dwc2_gadget_exit_clock_gating() returns, causing a deadlock when spin_lock_irqsave() is subsequently called in the same function. The fix acquires hsotg->lock before the call and releases it afterward (GitHub Advisory).

Exploitation of this vulnerability results in a local denial of service condition. A low-privileged local user can trigger a kernel deadlock during USB gadget driver shutdown — for example, by disconnecting a USB device or unloading the dwc2 driver — causing the system to hang and become unresponsive. There is no confidentiality or integrity impact; the vulnerability is limited to availability of the affected system (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024%, reflecting a very low probability of exploitation in the near term (GitHub Advisory).

Patches are available in the upstream Linux kernel stable trees. Fixed versions include: 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, and 7.0 (stable). Administrators should update to a patched kernel version as the primary remediation. As a temporary workaround, limiting USB gadget driver usage and avoiding unnecessary device disconnect/reconnect cycles on affected systems can reduce the risk of triggering the deadlock condition (GitHub Advisory, Red Hat Bugzilla).