CVE-2026-31757: Linux Kernel USB DOS Vulnerability

CVE-2026-31757 Overview

CVE-2026-31757 is a memory leak vulnerability in the Linux kernel's USB I/O misc driver (usb: misc: usbio). When usb_submit_urb() fails inside usbio_probe(), the previously allocated USB Request Block (URB) is never released. This results in kernel memory being leaked each time the probe error path is taken. The Linux kernel maintainers have resolved the issue by redirecting the failure path to the err_free_urb label so the URB is properly freed. The fix is tracked across multiple stable kernel commits.

Critical Impact
Repeated probe failures on systems exposed to faulty or malicious USB devices can exhaust kernel memory over time, leading to degraded performance or denial of service on affected Linux hosts.

Affected Products

Linux kernel versions containing the usb: misc: usbio driver prior to the fix
Linux distributions shipping kernels that include the affected usbio_probe() code path
Systems exposing USB I/O bridge devices handled by the usbio misc driver

Discovery Timeline

2026-05-01 - CVE-2026-31757 published to NVD
2026-05-01 - Last updated in NVD database

Technical Details for CVE-2026-31757

Vulnerability Analysis

The defect resides in the usbio_probe() function of the usb: misc: usbio driver in the Linux kernel. During device probing, the driver allocates a URB to communicate with the underlying USB hardware. The driver then submits the URB using usb_submit_urb(). When that submission call returns an error, the existing error path returned without releasing the URB allocation. Each failed probe consequently leaks the URB structure and any associated transfer buffers in kernel memory. While a single leak is small, repeated probe attempts compound the loss of unreclaimable kernel memory.

Root Cause

The root cause is an incorrect error-handling path inside usbio_probe(). The original code took a direct return on usb_submit_urb() failure rather than unwinding prior allocations. The fix replaces the direct return with a goto err_free_urb, which routes execution through the proper cleanup label that calls usb_free_urb(). This pattern matches standard Linux kernel resource-management conventions for probe routines and falls under the general class of memory leak weaknesses [CWE-401].

Attack Vector

The attack vector requires interaction with the affected USB driver's probe routine. An attacker with the ability to attach USB devices, or to repeatedly trigger conditions that cause usb_submit_urb() to fail, can force the leak to recur. Because USB device attachment typically requires local or physical access, network exploitation is not applicable. The condition is a reliability and resource-exhaustion issue rather than a code-execution flaw, and there is no public exploit, no entry on the CISA Known Exploited Vulnerabilities catalog, and no Exploit-DB record. The EPSS probability is 0.022%, placing the CVE at the 6.2 percentile.

No verified proof-of-concept code is available. The mechanism is described in the upstream commits referenced below; consult the Kernel Git Commit 1762dc4, Kernel Git Commit 33cfe07, and Kernel Git Commit 65ff09f for the source-level changes.

Detection Methods for CVE-2026-31757

Indicators of Compromise

Kernel log entries showing repeated usbio_probe failures or usb_submit_urb errors on systems using the usbio driver.
Steady, unexplained growth in kernel Slab memory reported by /proc/meminfo or slabtop correlated with USB device events.
Frequent disconnect-reconnect cycles for devices bound to the usbio driver in dmesg.

Detection Strategies

Compare the running kernel version against the patched commits to identify hosts that still ship the vulnerable usbio_probe() code path.
Monitor kmemleak output on test systems to confirm whether URB allocations remain unreferenced after probe failures.
Audit endpoint telemetry for unusual volumes of USB attach events on Linux servers and workstations that should not see frequent USB activity.

Monitoring Recommendations

Track kernel slab cache growth over time and alert on sustained increases without a corresponding workload change.
Forward dmesg and journald USB subsystem messages to a centralized log platform for correlation across the fleet.
Inventory Linux hosts and their kernel build identifiers to verify patch coverage after distribution updates are released.

How to Mitigate CVE-2026-31757

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable commits 1762dc4, 33cfe07, and 65ff09f as soon as your distribution publishes updated packages.
Reboot affected systems after kernel package upgrades so the patched usbio driver is loaded.
Restrict physical and administrative access to USB ports on systems where the usbio driver is active.

Patch Information

The vulnerability is fixed by routing usb_submit_urb() failure paths in usbio_probe() through the err_free_urb label, which calls usb_free_urb() before returning. The change is committed upstream and backported to stable trees. Reference the Kernel Git Commit 1762dc4, Kernel Git Commit 33cfe07, and Kernel Git Commit 65ff09f for the exact source-level changes, and follow your Linux distribution's advisories for packaged updates.

Workarounds

Blacklist the usbio kernel module on systems that do not require USB I/O bridge functionality until a patched kernel can be installed.
Apply USB device authorization policies via udev to limit which devices can bind to the usbio driver.
Schedule periodic reboots on long-running hosts where the driver cannot be unloaded, to reclaim leaked kernel memory.

bash

# Configuration example: prevent the usbio driver from loading until patched
echo "blacklist usbio" | sudo tee /etc/modprobe.d/blacklist-usbio.conf
sudo update-initramfs -u
# Verify the module is not currently loaded
lsmod | grep usbio