CVE-2026-31723

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31723", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.134Z", "datePublished": "2026-05-01T14:14:24.876Z", "dateUpdated": "2026-10-30T12:24:37.385Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:24:37.385Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_subset: Fix net_device lifecycle with device_move\n\nThe net_device is allocated during function instance creation and\nregistered during the bind phase with the gadget device as its sysfs\nparent. When the function unbinds, the parent device is destroyed, but\nthe net_device survives, resulting in dangling sysfs symlinks:\n\n console:/ # ls -l /sys/class/net/usb0\n lrwxrwxrwx ... /sys/class/net/usb0 ->\n /sys/devices/platform/.../gadget.0/net/usb0\n console:/ # ls -l /sys/devices/platform/.../gadget.0/net/usb0\n ls: .../gadget.0/net/usb0: No such file or directory\n\nUse device_move() to reparent the net_device between the gadget device\ntree and /sys/devices/virtual across bind and unbind cycles. During the\nfinal unbind, calling device_move(NULL) moves the net_device to the\nvirtual device tree before the gadget device is destroyed. On rebinding,\ndevice_move() reparents the device back under the new gadget, ensuring\nproper sysfs topology and power management ordering.\n\nTo maintain compatibility with legacy composite drivers (e.g., multi.c),\nthe bound flag is used to indicate whether the network device is shared\nand pre-registered during the legacy driver's bind phase."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/gadget/function/f_subset.c", "drivers/usb/gadget/function/u_gether.h"], "versions": [{"version": "8cedba7c73af1369599b1111639cfeb66fe13aaa", "lessThan": "c26916e8413c8fc44834fd9df4899312fd6cf880", "status": "affected", "versionType": "git"}, {"version": "8cedba7c73af1369599b1111639cfeb66fe13aaa", "lessThan": "edb08047051883591517feb5a51bf2bfd2b769fb", "status": "affected", "versionType": "git"}, {"version": "8cedba7c73af1369599b1111639cfeb66fe13aaa", "lessThan": "70707ce668494c4d35fe070dfbc7cc541b293107", "status": "affected", "versionType": "git"}, {"version": "8cedba7c73af1369599b1111639cfeb66fe13aaa", "lessThan": "9cbc4f109bb216623894d8819fb930210ed34b21", "status": "affected", "versionType": "git"}, {"version": "8cedba7c73af1369599b1111639cfeb66fe13aaa", "lessThan": "fde29916e4cc736c4ca6c78f331e12b2c73ccafd", "status": "affected", "versionType": "git"}, {"version": "8cedba7c73af1369599b1111639cfeb66fe13aaa", "lessThan": "06524cd1c9011bee141a87e43ab878641ed3652b", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/gadget/function/f_subset.c", "drivers/usb/gadget/function/u_gether.h"], "versions": [{"version": "3.11", "status": "affected"}, {"version": "0", "lessThan": "3.11", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.81", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.22", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.12", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.11", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.11", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.11", "versionEndExcluding": "6.12.81"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.11", "versionEndExcluding": "6.18.22"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.11", "versionEndExcluding": "6.19.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.11", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/c26916e8413c8fc44834fd9df4899312fd6cf880"}, {"url": "https://git.kernel.org/stable/c/edb08047051883591517feb5a51bf2bfd2b769fb"}, {"url": "https://git.kernel.org/stable/c/70707ce668494c4d35fe070dfbc7cc541b293107"}, {"url": "https://git.kernel.org/stable/c/9cbc4f109bb216623894d8819fb930210ed34b21"}, {"url": "https://git.kernel.org/stable/c/fde29916e4cc736c4ca6c78f331e12b2c73ccafd"}, {"url": "https://git.kernel.org/stable/c/06524cd1c9011bee141a87e43ab878641ed3652b"}], "title": "usb: gadget: f_subset: Fix net_device lifecycle with device_move", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/usb/gadget/function/f_subset.c", "drivers/usb/gadget/function/u_gether.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "c26916e8413c8fc44834fd9df4899312fd6cf880", "status": "affected", "version": "8cedba7c73af1369599b1111639cfeb66fe13aaa", "versionType": "git"}, {"lessThan": "edb08047051883591517feb5a51bf2bfd2b769fb", "status": "affected", "version": "8cedba7c73af1369599b1111639cfeb66fe13aaa", "versionType": "git"}, {"lessThan": "70707ce668494c4d35fe070dfbc7cc541b293107", "status": "affected", "version": "8cedba7c73af1369599b1111639cfeb66fe13aaa", "versionType": "git"}, {"lessThan": "9cbc4f109bb216623894d8819fb930210ed34b21", "status": "affected", "version": "8cedba7c73af1369599b1111639cfeb66fe13aaa", "versionType": "git"}, {"lessThan": "fde29916e4cc736c4ca6c78f331e12b2c73ccafd", "status": "affected", "version": "8cedba7c73af1369599b1111639cfeb66fe13aaa", "versionType": "git"}, {"lessThan": "06524cd1c9011bee141a87e43ab878641ed3652b", "status": "affected", "version": "8cedba7c73af1369599b1111639cfeb66fe13aaa", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/usb/gadget/function/f_subset.c", "drivers/usb/gadget/function/u_gether.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.11"}, {"lessThan": "3.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.81", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.22", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.12", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "2DDEB484-A8B8-4ED2-B54C-C92F595BA13F", "versionEndExcluding": "6.12.81", "versionStartIncluding": "3.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C9DF8BCE-36D3-475D-9D21-19E4F02F9029", "versionEndExcluding": "6.18.22", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0A2B9540-02D5-41B4-B16A-82AF66FD4F36", "versionEndExcluding": "6.19.12", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_subset: Fix net_device lifecycle with device_move\n\nThe net_device is allocated during function instance creation and\nregistered during the bind phase with the gadget device as its sysfs\nparent. When the function unbinds, the parent device is destroyed, but\nthe net_device survives, resulting in dangling sysfs symlinks:\n\n console:/ # ls -l /sys/class/net/usb0\n lrwxrwxrwx ... /sys/class/net/usb0 ->\n /sys/devices/platform/.../gadget.0/net/usb0\n console:/ # ls -l /sys/devices/platform/.../gadget.0/net/usb0\n ls: .../gadget.0/net/usb0: No such file or directory\n\nUse device_move() to reparent the net_device between the gadget device\ntree and /sys/devices/virtual across bind and unbind cycles. During the\nfinal unbind, calling device_move(NULL) moves the net_device to the\nvirtual device tree before the gadget device is destroyed. On rebinding,\ndevice_move() reparents the device back under the new gadget, ensuring\nproper sysfs topology and power management ordering.\n\nTo maintain compatibility with legacy composite drivers (e.g., multi.c),\nthe bound flag is used to indicate whether the network device is shared\nand pre-registered during the legacy driver's bind phase."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nusb: gadget: f_subset: Solucionar el ciclo de vida de net_device con device_move\n\nEl net_device se asigna durante la creaci\u00f3n de la instancia de funci\u00f3n y se registra durante la fase de enlace con el dispositivo gadget como su padre sysfs. Cuando la funci\u00f3n se desenlaza, el dispositivo padre es destruido, pero el net_device sobrevive, lo que resulta en enlaces simb\u00f3licos sysfs colgantes:\n\n console:/ # ls -l /sys/class/net/usb0\n lrwxrwxrwx ... /sys/class/net/usb0 -> \n /sys/devices/platform/... / gadget.0/net/usb0\n console:/ # ls -l /sys/devices/platform/... / gadget.0/net/usb0\n ls: ... / gadget.0/net/usb0: No existe el archivo o directorio\n\nUsar device_move() para reparentar el net_device entre el \u00e1rbol de dispositivos gadget y /sys/devices/virtual a trav\u00e9s de los ciclos de enlace y desenlace. Durante el desenlace final, llamar a device_move(NULL) mueve el net_device al \u00e1rbol de dispositivos virtuales antes de que el dispositivo gadget sea destruido. Al reenlazar, device_move() reparenta el dispositivo de nuevo bajo el nuevo gadget, asegurando una topolog\u00eda sysfs adecuada y un ordenamiento de la gesti\u00f3n de energ\u00eda.\n\nPara mantener la compatibilidad con controladores compuestos heredados (p. ej., multi.c), se utiliza la bandera \u2019bound\u2019 para indicar si el dispositivo de red es compartido y pre-registrado durante la fase de enlace del controlador heredado."}], "id": "CVE-2026-31723", "lastModified": "2026-11-11T21:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-05-01T15:16:34.727", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/06524cd1c9011bee141a87e43ab878641ed3652b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/70707ce668494c4d35fe070dfbc7cc541b293107"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9cbc4f109bb216623894d8819fb930210ed34b21"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c26916e8413c8fc44834fd9df4899312fd6cf880"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/edb08047051883591517feb5a51bf2bfd2b769fb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/fde29916e4cc736c4ca6c78f331e12b2c73ccafd"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: usb: gadget: f_subset: Fix net_device lifecycle with device_move", "id": "2464425", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464425"}, "csaw": false, "cwe": "CWE-763", "details": ["A flaw was found in the Linux kernel's usb: gadget: f_subset component. This vulnerability arises from an issue in how network device resources are managed during the unbinding of a USB gadget function. When the parent device is destroyed, the associated network device may persist, creating non-functional links in the system's file structure. This improper resource handling can lead to system instability or unexpected behavior."], "name": "CVE-2026-31723", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-01T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31723\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31723\nhttps://lore.kernel.org/linux-cve-announce/2026050134-CVE-2026-31723-a0a7@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8cedba7c73af1369599b1111639cfeb66fe13aaa,70707ce668494c4d35fe070dfbc7cc541b293107)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8cedba7c73af1369599b1111639cfeb66fe13aaa,9cbc4f109bb216623894d8819fb930210ed34b21)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8cedba7c73af1369599b1111639cfeb66fe13aaa,fde29916e4cc736c4ca6c78f331e12b2c73ccafd)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8cedba7c73af1369599b1111639cfeb66fe13aaa,06524cd1c9011bee141a87e43ab878641ed3652b)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.11"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,3.11)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.81,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.22,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.12,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0, *)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-01T18:30:05.213171+00:00", "updated": "2026-05-07T18:30:25.980203+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}