CVE-2026-31757: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31757 is a memory leak vulnerability in the Linux kernel's USB miscellaneous driver (usb: misc: usbio) that occurs when a USB Request Block (URB) submission fails during device probe. When usb_submit_urb() fails in usbio_probe(), the previously allocated URB is never freed, causing kernel memory to leak. Affected versions include Linux kernel 6.18.x before 6.18.22, 6.19.x before 6.19.12, and Linux kernel 7.0 release candidates (rc1–rc6). It was published on May 1, 2026, with a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified under CWE-401 (Missing Release of Memory after Effective Lifetime) and CWE-772 (Missing Release of Resource after Effective Lifetime). In the usbio_probe() function, when usb_submit_urb() returns an error, the error-handling code path does not jump to the err_free_urb label, leaving the previously allocated URB object unreleased in kernel memory. The fix involves correcting the error path to properly call usb_free_urb() via the err_free_urb label on submission failure. Exploitation requires local access with low privileges, as an attacker or unprivileged user would need to trigger repeated USB device attachment and probe failure cycles (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation results in a kernel memory leak with no confidentiality or integrity impact, but a high availability impact. Repeated failed USB device probe events cause kernel memory to accumulate without release, potentially leading to out-of-memory (OOM) conditions, system performance degradation, and eventual instability or crash. The vulnerability is locally scoped and does not enable lateral movement or data exfiltration (GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.017% (3rd percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported (GitHub Advisory).

Apply the upstream Linux kernel patches that fix the URB memory leak in the usbio driver: commits 1762dc43b983, 33cfe0709b6b, and 65ff09f48b0e for the stable kernel branches. Fixed versions include Linux kernel 6.18.22, 6.19.12, and Linux kernel 7.0 (stable). As a workaround, restrict physical USB device access to trusted users and devices, and monitor kernel memory usage for abnormal growth patterns (GitHub Advisory, Red Hat Bugzilla).