CVE-2026-31722: Linux Kernel Privilege Escalation Flaw

CVE-2026-31722 Overview

CVE-2026-31722 is a Linux kernel vulnerability in the USB gadget RNDIS function driver (f_rndis). The flaw stems from improper lifecycle management of the net_device structure during USB gadget bind and unbind cycles. When a function unbinds, the gadget parent device is destroyed, but the net_device survives, leaving dangling sysfs symlinks under /sys/class/net/usb0. A local authenticated user with privileges to manipulate USB gadget configurations can trigger the condition, causing kernel-level instability and a denial-of-service impact on the affected system.

Critical Impact
Local users can trigger dangling sysfs references and disrupt USB gadget networking, leading to high availability impact on affected Linux kernels.

Affected Products

Linux Kernel (mainline development branches prior to the patch)
Linux Kernel 7.0-rc1 through 7.0-rc6 release candidates
Distributions shipping the affected usb_f_rndis gadget module

Discovery Timeline

2026-05-01 - CVE-2026-31722 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-31722

Vulnerability Analysis

The vulnerability resides in the USB gadget RNDIS function driver located in drivers/usb/gadget/function/f_rndis.c. The net_device is allocated during function instance creation and registered during the bind phase with the gadget device serving as its sysfs parent. When the function later unbinds, the parent device is torn down while the net_device continues to exist, leaving the sysfs topology inconsistent.

Users attempting to inspect /sys/devices/platform/.../gadget.0/net/usb0 encounter a missing entry, while /sys/class/net/usb0 continues to point to the deleted path. This breaks power management ordering and can corrupt subsequent rebind operations on the same gadget instance.

Root Cause

The root cause is incorrect parent-device lifetime management between the gadget device tree and the registered net_device. The function driver did not reparent the net_device before destroying the gadget parent, producing stale sysfs symlinks and inconsistent kobject relationships.

Attack Vector

Exploitation requires local access with privileges to configure USB gadget functions through ConfigFS. An attacker can repeatedly bind and unbind the RNDIS function to trigger the dangling reference state, leading to disruption of USB networking and broader kernel resource handling. The patch introduces device_move() to reparent the net_device to /sys/devices/virtual during unbind and back under the new gadget on rebind. A borrowed_net flag preserves compatibility with legacy composite drivers such as multi.c.

// No verified public exploit code is available for CVE-2026-31722.
// Refer to upstream kernel commits 18ada80, 1ef251a, 6045ea5, e367599
// for the authoritative patch and reproduction context.

Detection Methods for CVE-2026-31722

Indicators of Compromise

Dangling symlinks under /sys/class/net/usb0 pointing to non-existent gadget paths.
Repeated bind and unbind events for the usb_f_rndis module recorded in dmesg or kernel audit logs.
Unexpected kernel warnings or kobject errors referencing the RNDIS gadget function during USB reconfiguration.

Detection Strategies

Monitor kernel audit logs for ConfigFS operations targeting usb_gadget directories, particularly RNDIS function symlinks.
Inventory kernel versions across Linux fleets and flag systems running 7.0-rc1 through 7.0-rc6 or unpatched mainline builds.
Validate sysfs consistency by scripting checks that resolve /sys/class/net/* symlinks and report broken targets.

Monitoring Recommendations

Enable kernel pr_warn/pr_err log forwarding to a centralized logging pipeline to surface gadget driver anomalies.
Track USB gadget bind and unbind frequency on systems exposing ConfigFS to non-root users or container workloads.
Alert on local privilege changes that grant write access to /sys/kernel/config/usb_gadget.

How to Mitigate CVE-2026-31722

Immediate Actions Required

Apply the upstream kernel patches referenced by commits 18ada80, 1ef251a, 6045ea5, and e367599 from the stable Linux Git tree.
Restrict access to ConfigFS-based USB gadget configuration so that only trusted administrators can bind or unbind functions.
Audit systems using the usb_f_rndis module and disable RNDIS gadget functionality where it is not required.

Patch Information

The fix uses device_move() to reparent the net_device between the gadget device tree and /sys/devices/virtual across bind and unbind cycles. During the final unbind, device_move(NULL) moves the net_device to the virtual device tree before the gadget device is destroyed. On rebind, device_move() reparents the device back under the new gadget. Patches are available in the Kernel Git Commit 18ada80, Kernel Git Commit 1ef251a, Kernel Git Commit 6045ea5, and Kernel Git Commit e367599.

Workarounds

Unload the usb_f_rndis kernel module on systems that do not require RNDIS gadget networking.
Tighten permissions on /sys/kernel/config/usb_gadget to prevent unprivileged manipulation of gadget functions.
Avoid repeated runtime bind and unbind cycles of RNDIS gadget functions until the patched kernel is deployed.

bash

# Disable the vulnerable RNDIS gadget module until the kernel is patched
sudo modprobe -r usb_f_rndis
echo "blacklist usb_f_rndis" | sudo tee /etc/modprobe.d/disable-rndis.conf
sudo update-initramfs -u