CVE-2026-31723 Overview
CVE-2026-31723 affects the Linux kernel USB gadget subsystem, specifically the f_subset function driver. The vulnerability stems from improper net_device lifecycle management when the gadget device is destroyed during function unbind. The net_device survives its sysfs parent, leaving dangling symlinks under /sys/class/net/ and producing inconsistent device topology. A local user with the ability to trigger gadget bind and unbind cycles can induce kernel instability and impact availability on affected systems.
Critical Impact
Local privileged operations on the USB gadget subsystem can produce dangling sysfs references and disrupt power management ordering, leading to high availability impact on affected Linux kernel versions.
Affected Products
- Linux kernel 7.0-rc1 through 7.0-rc6
- Linux kernel stable branches receiving the f_subset backport
- Systems using the USB gadget f_subset (CDC Subset / EEM-style) function driver
Discovery Timeline
- 2026-05-01 - CVE-2026-31723 published to NVD
- 2026-05-07 - Last updated in NVD database
Technical Details for CVE-2026-31723
Vulnerability Analysis
The f_subset USB gadget function driver allocates a net_device during function instance creation. The kernel registers this net_device during the bind phase and assigns the gadget device as its sysfs parent. When the function unbinds, the gadget parent device is destroyed, but the net_device continues to exist.
This lifecycle mismatch produces dangling sysfs symlinks. A reference under /sys/class/net/usb0 points to a path beneath /sys/devices/platform/.../gadget.0/net/usb0 that no longer resolves. Subsequent operations on the network interface encounter inconsistent kernel state, and power management ordering becomes incorrect.
The fix introduces device_move() calls to reparent the net_device between the gadget device tree and /sys/devices/virtual across bind and unbind cycles. During final unbind, device_move(NULL) relocates the net_device to the virtual device tree before the gadget is destroyed. The patch also adds a bound flag to preserve compatibility with legacy composite drivers such as multi.c that share and pre-register the network device.
Root Cause
The root cause is incorrect device hierarchy management in the USB gadget f_subset driver. The driver registered the net_device with a parent whose lifetime was shorter than the child, violating the sysfs parent-child invariant.
Attack Vector
Exploitation requires local access with permissions to manipulate USB gadget configfs entries. The attacker repeatedly binds and unbinds the f_subset function to trigger the dangling reference condition. The vulnerability does not expose confidentiality or integrity, but it impacts availability through kernel state corruption.
No public proof-of-concept exists, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS exploitation likelihood is low based on current scoring.
Detection Methods for CVE-2026-31723
Indicators of Compromise
- Dangling symlinks under /sys/class/net/usb0 pointing to non-existent paths under /sys/devices/platform/.../gadget.0/net/
- Kernel log entries referencing f_subset bind or unbind sequences correlated with sysfs errors
- Failed ls or readlink operations on USB gadget network interfaces after function teardown
Detection Strategies
- Monitor dmesg and kernel ring buffer for warnings emitted during USB gadget function unbind
- Audit configfs operations under /sys/kernel/config/usb_gadget/ for repeated bind and unbind sequences from non-administrative users
- Track loaded kernel version against the patched commits 06524cd1c901, 70707ce66849, 9cbc4f109bb2, and fde29916e4cc
Monitoring Recommendations
- Collect kernel telemetry from Linux endpoints into a centralized log platform for anomaly review
- Alert on userspace processes performing rapid USB gadget reconfiguration cycles
- Track sysfs symlink integrity for network class devices on systems where USB gadget mode is enabled
How to Mitigate CVE-2026-31723
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the kernel.org commit 06524cd1c901 and related stable backports
- Restrict access to USB gadget configfs interfaces to root and trusted service accounts
- Disable the f_subset function driver where USB gadget networking is not required
Patch Information
The Linux kernel maintainers resolved CVE-2026-31723 in commits 70707ce66849, 9cbc4f109bb2, fde29916e4cc, and 06524cd1c901. The fix uses device_move() to reparent the net_device to /sys/devices/virtual during unbind and back to the gadget tree on rebind.
Workarounds
- Unload the usb_f_gnet or related f_subset modules on systems that do not require CDC subset gadget networking
- Apply mandatory access controls such as SELinux or AppArmor to restrict configfs writes to USB gadget paths
- Avoid scripted bind and unbind cycles of USB gadget functions on production systems until kernels are patched
# Verify kernel version and check whether f_subset module is loaded
uname -r
lsmod | grep -E 'usb_f_gnet|g_ether|g_multi'
# Restrict configfs gadget directory to root only
chmod 700 /sys/kernel/config/usb_gadget
# Optionally blacklist the module if gadget networking is not required
echo 'blacklist usb_f_gnet' | sudo tee /etc/modprobe.d/blacklist-f_subset.conf
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
