CVE-2026-31672: Linux Kernel rt2x00usb Devres Vulnerability

CVE-2026-31672 Overview

CVE-2026-31672 is a memory leak vulnerability in the Linux kernel's rt2x00usb WiFi driver. The vulnerability arises from improper device resource (devres) lifetime management, where USB drivers bind to USB interfaces but device-managed resources have their lifetime incorrectly tied to the parent USB device rather than the interface itself. This leads to memory leaks when drivers are unbound without their devices being physically disconnected, such as during probe deferral or configuration changes.

Critical Impact
Local attackers can trigger memory exhaustion through repeated driver unbind operations, potentially causing system instability or denial of service on systems using affected Ralink/MediaTek USB WiFi adapters.

Affected Products

Linux Kernel versions from 4.7 through 7.0-rc7
Systems using Ralink rt2x00 USB WiFi chipsets
Embedded Linux devices with USB WiFi adapters using the rt2x00usb driver

Discovery Timeline

2026-04-24 - CVE CVE-2026-31672 published to NVD
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-31672

Vulnerability Analysis

This vulnerability is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). The rt2x00usb driver incorrectly manages the USB anchor resource lifetime, causing memory to not be properly released when the driver unbinds from a USB interface. In the Linux kernel's device resource management model, resources allocated with devm_* functions should be tied to the device they're associated with so they're automatically freed when the device is removed. However, in the affected code, the USB anchor was tied to the parent USB device rather than the USB interface that the driver binds to.

When a USB WiFi driver is repeatedly bound and unbound (which can happen during probe deferrals, power management events, or configuration changes), the memory allocated for the USB anchor is never released because the parent USB device remains present. Over time, this leads to kernel memory exhaustion.

Root Cause

The root cause is an architectural error in the rt2x00usb driver's resource allocation. USB drivers in Linux bind to USB interfaces, not USB devices directly. Device-managed resources should therefore have their lifetime tied to the interface (&intf->dev) rather than the parent USB device (&usb_dev->dev). The original implementation incorrectly associated the USB anchor with the parent device, causing the resource to persist beyond the driver's lifetime when unbound.

Attack Vector

The vulnerability requires local access to exploit. An attacker with local privileges could trigger repeated driver unbind/rebind cycles through several methods:

The attack involves manipulating the USB driver binding process. An attacker can force driver unbind operations via sysfs, trigger probe deferrals by manipulating device configurations, or exploit USB power management events to cause repeated driver state transitions. Each cycle leaks memory from the USB anchor allocation, eventually exhausting kernel memory and causing system instability or denial of service.

Detection Methods for CVE-2026-31672

Indicators of Compromise

Increasing kernel memory usage (observable via /proc/meminfo slab allocation growth)
System logs showing repeated rt2x00usb driver bind/unbind events
Memory allocation failures in kernel logs after prolonged USB WiFi usage
Unexplained system slowdown on systems with USB WiFi adapters

Detection Strategies

Monitor kernel memory usage patterns, specifically slab allocations related to USB subsystems
Implement system logging analysis to detect abnormal driver bind/unbind frequencies
Use kernel memory debugging tools like kmemleak to identify unreleased memory blocks
Configure alerts for rapid succession of USB driver state changes in system logs

Monitoring Recommendations

Enable kernel memory leak detection (CONFIG_DEBUG_KMEMLEAK) in development and testing environments
Monitor /sys/kernel/debug/kmemleak for rt2x00-related memory leaks
Set up automated monitoring for kernel memory growth over time on systems with USB WiFi
Review dmesg logs periodically for rt2x00usb driver warning messages

How to Mitigate CVE-2026-31672

Immediate Actions Required

Update to a patched Linux kernel version that includes the devres lifetime fix
Limit physical and logical access to systems with vulnerable USB WiFi configurations
Consider temporarily using alternative WiFi drivers or wired networking if updates cannot be immediately applied
Monitor affected systems for signs of memory exhaustion until patches can be deployed

Patch Information

The Linux kernel maintainers have released patches across multiple stable kernel branches. The fix corrects the USB anchor lifetime so that it is properly released on driver unbind rather than persisting with the parent USB device.

Patches are available through the following kernel commits:

Workarounds

Blacklist the rt2x00usb module if USB WiFi is not required: add blacklist rt2x00usb to /etc/modprobe.d/blacklist.conf
Physically remove USB WiFi adapters from affected systems until patches are applied
Use PCI-based WiFi adapters as an alternative if USB WiFi is not essential
Implement resource monitoring to proactively reboot affected systems before memory exhaustion occurs

bash

# Temporary workaround: Blacklist the vulnerable driver module
echo "blacklist rt2x00usb" | sudo tee /etc/modprobe.d/cve-2026-31672.conf
echo "blacklist rt2800usb" | sudo tee -a /etc/modprobe.d/cve-2026-31672.conf

# Apply blacklist without reboot (removes currently loaded module)
sudo modprobe -r rt2800usb rt2x00usb 2>/dev/null || true

# Verify module is not loaded
lsmod | grep rt2x00