CVE-2026-31721 Details
Description
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_hid: move list and spinlock inits from bind to alloc There was an issue when you did the following: - setup and bind an hid gadget - open /dev/hidg0 - use the resulting fd in EPOLL_CTL_ADD - unbind the UDC - bind the UDC - use the fd in EPOLL_CTL_DEL When CONFIG_DEBUG_LIST was enabled, a list_del corruption was reported within remove_wait_queue (via ep_remove_wait_queue). After some debugging I found out that the queues, which f_hid registers via poll_wait were the problem. These were initialized using init_waitqueue_head inside hidg_bind. So effectively, the bind function re-initialized the queues while there were still items in them. The solution is to move the initialization from hidg_bind to hidg_alloc to extend their lifetimes to the lifetime of the function instance. Additionally, I found many other possibly problematic init calls in the bind function, which I moved as well.
A vulnerability exists in the Linux kernel's HID gadget function, specifically in versions prior to the latest patch, where improper initialization of data structures can lead to corruption issues. This problem arises when the HID gadget is set up and bound, and then the USB Device Controller (UDC) is unbound and rebound while the gadget is still active. The issue is exacerbated when the kernel's debug list feature is enabled, as it can cause a corruption of the list management used by the event polling system. The root cause is the re-initialization of wait queues by the bind function, which disrupts the normal operation of the HID gadget. Exploiting this vulnerability can cause unexpected behavior in the HID gadget's operation, potentially leading to data loss or corruption.
The vulnerability has been addressed by moving the initialization of the HID gadget's spinlocks and wait queues from the bind function to the allocation function. Users should update to the latest version of the Linux kernel where this patch has been applied.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/13440c0db227c5db01da751ed966dde4cdd2ea18 | kernel.org | Patch |
| https://git.kernel.org/stable/c/26a879a41ed960b3fb4ec773ef2788c515c0e488 | kernel.org | Patch |
| https://git.kernel.org/stable/c/4e0a88254ad59f6c53a34bf5fa241884ec09e8b2 | kernel.org | Patch |
| https://git.kernel.org/stable/c/5d1bb391ceeebb28327703dd07af8c6324af298f | kernel.org | Patch |
| https://git.kernel.org/stable/c/81aee4500055876883658b024b6fb61801afe134 | kernel.org | Patch |
| https://git.kernel.org/stable/c/8ec6a58586f195a88479edcdb0b8027c39f12d03 | kernel.org | Patch |
| https://git.kernel.org/stable/c/de93e0862169b5539e00c2b9980b93fd80c37c0d | kernel.org | Patch |
| https://git.kernel.org/stable/c/f7d00ee1c8082c8a134340aaf16d71a27e29c362 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 3.19, < 5.10.253 >= 5.11, < 5.15.203 >= 5.16, < 6.1.169 >= 6.2, < 6.6.135 >= 6.7, < 6.12.81 >= 6.13, < 6.18.22 >= 6.19, < 6.19.12 7.0 rc1 7.0 rc2 7.0 rc3 7.0 rc4 7.0 rc5 7.0 rc6 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| May 6, 2026 | Initial Analysis | [email protected] |
| May 1, 2026 | New CVE Received | kernel.org |