CVE-2026-31726

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31726", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.134Z", "datePublished": "2026-05-01T14:14:26.882Z", "dateUpdated": "2026-05-23T16:05:51.035Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-23T16:05:51.035Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: uvc: fix NULL pointer dereference during unbind race\n\nCommit b81ac4395bbe (\"usb: gadget: uvc: allow for application to cleanly\nshutdown\") introduced two stages of synchronization waits totaling 1500ms\nin uvc_function_unbind() to prevent several types of kernel panics.\nHowever, this timing-based approach is insufficient during power\nmanagement (PM) transitions.\n\nWhen the PM subsystem starts freezing user space processes, the\nwait_event_interruptible_timeout() is aborted early, which allows the\nunbind thread to proceed and nullify the gadget pointer\n(cdev->gadget = NULL):\n\n[ 814.123447][ T947] configfs-gadget.g1 gadget.0: uvc: uvc_function_unbind()\n[ 814.178583][ T3173] PM: suspend entry (deep)\n[ 814.192487][ T3173] Freezing user space processes\n[ 814.197668][ T947] configfs-gadget.g1 gadget.0: uvc: uvc_function_unbind no clean disconnect, wait for release\n\nWhen the PM subsystem resumes or aborts the suspend and tasks are\nrestarted, the V4L2 release path is executed and attempts to access the\nalready nullified gadget pointer, triggering a kernel panic:\n\n[ 814.292597][ C0] PM: pm_system_irq_wakeup: 479 triggered dhdpcie_host_wake\n[ 814.386727][ T3173] Restarting tasks ...\n[ 814.403522][ T4558] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000030\n[ 814.404021][ T4558] pc : usb_gadget_deactivate+0x14/0xf4\n[ 814.404031][ T4558] lr : usb_function_deactivate+0x54/0x94\n[ 814.404078][ T4558] Call trace:\n[ 814.404080][ T4558] usb_gadget_deactivate+0x14/0xf4\n[ 814.404083][ T4558] usb_function_deactivate+0x54/0x94\n[ 814.404087][ T4558] uvc_function_disconnect+0x1c/0x5c\n[ 814.404092][ T4558] uvc_v4l2_release+0x44/0xac\n[ 814.404095][ T4558] v4l2_release+0xcc/0x130\n\nAddress the race condition and NULL pointer dereference by:\n\n1. State Synchronization (flag + mutex)\nIntroduce a 'func_unbound' flag in struct uvc_device. This allows\nuvc_function_disconnect() to safely skip accessing the nullified\ncdev->gadget pointer. As suggested by Alan Stern, this flag is protected\nby a new mutex (uvc->lock) to ensure proper memory ordering and prevent\ninstruction reordering or speculative loads. This mutex is also used to\nprotect 'func_connected' for consistent state management.\n\n2. Explicit Synchronization (completion)\nUse a completion to synchronize uvc_function_unbind() with the\nuvc_vdev_release() callback. This prevents Use-After-Free (UAF) by\nensuring struct uvc_device is freed after all video device resources\nare released."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/gadget/function/f_uvc.c", "drivers/usb/gadget/function/uvc.h", "drivers/usb/gadget/function/uvc_v4l2.c"], "versions": [{"version": "1444e0568bc2c70868e7b8da5b46fc2252acc3f5", "lessThan": "0c00ec409d7b2bce3fcac73188b79a141db7cfda", "status": "affected", "versionType": "git"}, {"version": "4962e5a2f301d24953f17d6748d986e21566abe1", "lessThan": "d92d1532e05b1b31d36d48765e43bf73d793d19f", "status": "affected", "versionType": "git"}, {"version": "b81ac4395bbeaf36e078dea1a48c02dd97b76235", "lessThan": "0587de744615628c38e33ddc1601160a5ea8c50a", "status": "affected", "versionType": "git"}, {"version": "b81ac4395bbeaf36e078dea1a48c02dd97b76235", "lessThan": "c78e463ee134b4669579d453c81ae00795e4c19a", "status": "affected", "versionType": "git"}, {"version": "b81ac4395bbeaf36e078dea1a48c02dd97b76235", "lessThan": "8a1128d604c360eca135f15b882b70256a522145", "status": "affected", "versionType": "git"}, {"version": "b81ac4395bbeaf36e078dea1a48c02dd97b76235", "lessThan": "1aa9356881ee4ed414bf72d0c56d915492cb5345", "status": "affected", "versionType": "git"}, {"version": "b81ac4395bbeaf36e078dea1a48c02dd97b76235", "lessThan": "c038ba56b92e410d1caec22b2dc68780a0b42091", "status": "affected", "versionType": "git"}, {"version": "b81ac4395bbeaf36e078dea1a48c02dd97b76235", "lessThan": "eba2936bbe6b752a31725a9eb5c674ecbf21ee7d", "status": "affected", "versionType": "git"}, {"version": "e10735ce87502b07e171727e574afdd6c0890a08", "status": "affected", "versionType": "git"}, {"version": "5.10.117", "lessThan": "5.10.253", "status": "affected", "versionType": "semver"}, {"version": "5.15.41", "lessThan": "5.15.203", "status": "affected", "versionType": "semver"}, {"version": "5.17.9", "lessThan": "5.18", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/gadget/function/f_uvc.c", "drivers/usb/gadget/function/uvc.h", "drivers/usb/gadget/function/uvc_v4l2.c"], "versions": [{"version": "5.18", "status": "affected"}, {"version": "0", "lessThan": "5.18", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.253", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.203", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.168", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.134", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.81", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.22", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.12", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.117", "versionEndExcluding": "5.10.253"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.41", "versionEndExcluding": "5.15.203"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.1.168"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.6.134"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.12.81"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.18.22"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.19.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "7.0"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17.9"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/0c00ec409d7b2bce3fcac73188b79a141db7cfda"}, {"url": "https://git.kernel.org/stable/c/d92d1532e05b1b31d36d48765e43bf73d793d19f"}, {"url": "https://git.kernel.org/stable/c/0587de744615628c38e33ddc1601160a5ea8c50a"}, {"url": "https://git.kernel.org/stable/c/c78e463ee134b4669579d453c81ae00795e4c19a"}, {"url": "https://git.kernel.org/stable/c/8a1128d604c360eca135f15b882b70256a522145"}, {"url": "https://git.kernel.org/stable/c/1aa9356881ee4ed414bf72d0c56d915492cb5345"}, {"url": "https://git.kernel.org/stable/c/c038ba56b92e410d1caec22b2dc68780a0b42091"}, {"url": "https://git.kernel.org/stable/c/eba2936bbe6b752a31725a9eb5c674ecbf21ee7d"}], "title": "usb: gadget: uvc: fix NULL pointer dereference during unbind race", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/usb/gadget/function/f_uvc.c", "drivers/usb/gadget/function/uvc.h", "drivers/usb/gadget/function/uvc_v4l2.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "0c00ec409d7b2bce3fcac73188b79a141db7cfda", "status": "affected", "version": "1444e0568bc2c70868e7b8da5b46fc2252acc3f5", "versionType": "git"}, {"lessThan": "d92d1532e05b1b31d36d48765e43bf73d793d19f", "status": "affected", "version": "4962e5a2f301d24953f17d6748d986e21566abe1", "versionType": "git"}, {"lessThan": "0587de744615628c38e33ddc1601160a5ea8c50a", "status": "affected", "version": "b81ac4395bbeaf36e078dea1a48c02dd97b76235", "versionType": "git"}, {"lessThan": "c78e463ee134b4669579d453c81ae00795e4c19a", "status": "affected", "version": "b81ac4395bbeaf36e078dea1a48c02dd97b76235", "versionType": "git"}, {"lessThan": "8a1128d604c360eca135f15b882b70256a522145", "status": "affected", "version": "b81ac4395bbeaf36e078dea1a48c02dd97b76235", "versionType": "git"}, {"lessThan": "1aa9356881ee4ed414bf72d0c56d915492cb5345", "status": "affected", "version": "b81ac4395bbeaf36e078dea1a48c02dd97b76235", "versionType": "git"}, {"lessThan": "c038ba56b92e410d1caec22b2dc68780a0b42091", "status": "affected", "version": "b81ac4395bbeaf36e078dea1a48c02dd97b76235", "versionType": "git"}, {"lessThan": "eba2936bbe6b752a31725a9eb5c674ecbf21ee7d", "status": "affected", "version": "b81ac4395bbeaf36e078dea1a48c02dd97b76235", "versionType": "git"}, {"status": "affected", "version": "e10735ce87502b07e171727e574afdd6c0890a08", "versionType": "git"}, {"lessThan": "5.10.253", "status": "affected", "version": "5.10.117", "versionType": "semver"}, {"lessThan": "5.15.203", "status": "affected", "version": "5.15.41", "versionType": "semver"}, {"lessThan": "5.18", "status": "affected", "version": "5.17.9", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/usb/gadget/function/f_uvc.c", "drivers/usb/gadget/function/uvc.h", "drivers/usb/gadget/function/uvc_v4l2.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.18"}, {"lessThan": "5.18", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.253", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.203", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.168", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.134", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.81", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.22", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.12", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "3107A7FD-A692-4C8A-AEB6-F0D2F2662FB9", "versionEndExcluding": "5.10.253", "versionStartIncluding": "5.10.117", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "10AB2B1C-2087-4373-A0B0-DF5A1661F0BA", "versionEndExcluding": "5.15.203", "versionStartIncluding": "5.15.41", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "BA6F49FC-BA51-4640-976D-34617774A48C", "versionEndExcluding": "6.1.168", "versionStartIncluding": "5.18", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F56F925B-BAF8-4F4B-B62F-1496AF19A307", "versionEndExcluding": "6.6.134", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC", "versionEndExcluding": "6.12.81", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C9DF8BCE-36D3-475D-9D21-19E4F02F9029", "versionEndExcluding": "6.18.22", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0A2B9540-02D5-41B4-B16A-82AF66FD4F36", "versionEndExcluding": "6.19.12", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: uvc: fix NULL pointer dereference during unbind race\n\nCommit b81ac4395bbe (\"usb: gadget: uvc: allow for application to cleanly\nshutdown\") introduced two stages of synchronization waits totaling 1500ms\nin uvc_function_unbind() to prevent several types of kernel panics.\nHowever, this timing-based approach is insufficient during power\nmanagement (PM) transitions.\n\nWhen the PM subsystem starts freezing user space processes, the\nwait_event_interruptible_timeout() is aborted early, which allows the\nunbind thread to proceed and nullify the gadget pointer\n(cdev->gadget = NULL):\n\n[ 814.123447][ T947] configfs-gadget.g1 gadget.0: uvc: uvc_function_unbind()\n[ 814.178583][ T3173] PM: suspend entry (deep)\n[ 814.192487][ T3173] Freezing user space processes\n[ 814.197668][ T947] configfs-gadget.g1 gadget.0: uvc: uvc_function_unbind no clean disconnect, wait for release\n\nWhen the PM subsystem resumes or aborts the suspend and tasks are\nrestarted, the V4L2 release path is executed and attempts to access the\nalready nullified gadget pointer, triggering a kernel panic:\n\n[ 814.292597][ C0] PM: pm_system_irq_wakeup: 479 triggered dhdpcie_host_wake\n[ 814.386727][ T3173] Restarting tasks ...\n[ 814.403522][ T4558] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000030\n[ 814.404021][ T4558] pc : usb_gadget_deactivate+0x14/0xf4\n[ 814.404031][ T4558] lr : usb_function_deactivate+0x54/0x94\n[ 814.404078][ T4558] Call trace:\n[ 814.404080][ T4558] usb_gadget_deactivate+0x14/0xf4\n[ 814.404083][ T4558] usb_function_deactivate+0x54/0x94\n[ 814.404087][ T4558] uvc_function_disconnect+0x1c/0x5c\n[ 814.404092][ T4558] uvc_v4l2_release+0x44/0xac\n[ 814.404095][ T4558] v4l2_release+0xcc/0x130\n\nAddress the race condition and NULL pointer dereference by:\n\n1. State Synchronization (flag + mutex)\nIntroduce a 'func_unbound' flag in struct uvc_device. This allows\nuvc_function_disconnect() to safely skip accessing the nullified\ncdev->gadget pointer. As suggested by Alan Stern, this flag is protected\nby a new mutex (uvc->lock) to ensure proper memory ordering and prevent\ninstruction reordering or speculative loads. This mutex is also used to\nprotect 'func_connected' for consistent state management.\n\n2. Explicit Synchronization (completion)\nUse a completion to synchronize uvc_function_unbind() with the\nuvc_vdev_release() callback. This prevents Use-After-Free (UAF) by\nensuring struct uvc_device is freed after all video device resources\nare released."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nusb: gadget: uvc: corregir desreferencia de puntero NULL durante una condici\u00f3n de carrera de desvinculaci\u00f3n\n\nEl commit b81ac4395bbe (\u2019usb: gadget: uvc: permitir que la aplicaci\u00f3n se apague limpiamente\u2019) introdujo dos etapas de esperas de sincronizaci\u00f3n que suman 1500ms en uvc_function_unbind() para prevenir varios tipos de p\u00e1nicos del kernel. Sin embargo, este enfoque basado en tiempo es insuficiente durante las transiciones de gesti\u00f3n de energ\u00eda (PM).\n\nCuando el subsistema PM comienza a congelar los procesos del espacio de usuario, la wait_event_interruptible_timeout() se aborta prematuramente, lo que permite que el hilo de desvinculaci\u00f3n contin\u00fae y anule el puntero del gadget (cdev -> gadget = NULL):\n\n[ 814.123447][ T947] configfs-gadget.g1 gadget.0: uvc: uvc_function_unbind()\n[ 814.178583][ T3173] PM: suspend entry (deep)\n[ 814.192487][ T3173] Freezing user space processes\n[ 814.197668][ T947] configfs-gadget.g1 gadget.0: uvc: uvc_function_unbind no clean disconnect, wait for release\n\nCuando el subsistema PM reanuda o aborta la suspensi\u00f3n y las tareas se reinician, la ruta de liberaci\u00f3n de V4L2 se ejecuta e intenta acceder al puntero del gadget ya anulado, lo que desencadena un p\u00e1nico del kernel:\n\n[ 814.292597][ C0] PM: pm_system_irq_wakeup: 479 triggered dhdpcie_host_wake\n[ 814.386727][ T3173] Restarting tasks ...\n[ 814.403522][ T4558] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000030\n[ 814.404021][ T4558] pc : usb_gadget_deactivate+0x14/0xf4\n[ 814.404031][ T4558] lr : usb_function_deactivate+0x54/0x94\n[ 814.404078][ T4558] Call trace:\n[ 814.404080][ T4558] usb_gadget_deactivate+0x14/0xf4\n[ 814.404083][ T4558] usb_function_deactivate+0x54/0x94\n[ 814.404087][ T4558] uvc_function_disconnect+0x1c/0x5c\n[ 814.404092][ T4558] uvc_v4l2_release+0x44/0xac\n[ 814.404095][ T4558] v4l2_release+0xcc/0x130\n\nAbordar la condici\u00f3n de carrera y la desreferencia de puntero NULL mediante:\n\n1. Sincronizaci\u00f3n de estado (bandera + mutex)\nIntroducir una bandera \u2019func_unbound\u2019 en la estructura uvc_device. Esto permite que uvc_function_disconnect() omita de forma segura el acceso al puntero cdev -> gadget anulado. Como sugiri\u00f3 Alan Stern, esta bandera est\u00e1 protegida por un nuevo mutex (uvc -> lock) para asegurar un ordenamiento de memoria adecuado y prevenir el reordenamiento de instrucciones o cargas especulativas. Este mutex tambi\u00e9n se utiliza para proteger \u2019func_connected\u2019 para una gesti\u00f3n de estado consistente.\n\n2. Sincronizaci\u00f3n expl\u00edcita (finalizaci\u00f3n)\nUsar una finalizaci\u00f3n para sincronizar uvc_function_unbind() con la devoluci\u00f3n de llamada uvc_vdev_release(). Esto previene el Uso despu\u00e9s de liberaci\u00f3n (UAF) asegurando que la estructura uvc_device se libere despu\u00e9s de que todos los recursos del dispositivo de video sean liberados."}], "id": "CVE-2026-31726", "lastModified": "2026-11-11T21:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-05-01T15:16:35.063", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0587de744615628c38e33ddc1601160a5ea8c50a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0c00ec409d7b2bce3fcac73188b79a141db7cfda"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1aa9356881ee4ed414bf72d0c56d915492cb5345"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8a1128d604c360eca135f15b882b70256a522145"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c038ba56b92e410d1caec22b2dc68780a0b42091"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c78e463ee134b4669579d453c81ae00795e4c19a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d92d1532e05b1b31d36d48765e43bf73d793d19f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/eba2936bbe6b752a31725a9eb5c674ecbf21ee7d"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: usb: gadget: uvc: fix NULL pointer dereference during unbind race", "id": "2464349", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464349"}, "csaw": false, "cwe": "CWE-367", "details": ["A flaw was found in the Linux kernel's USB Video Class (UVC) gadget driver. A race condition during power management (PM) transitions can cause a null pointer dereference. This occurs when the system attempts to access a deallocated gadget pointer, leading to a kernel panic. This vulnerability can be triggered by a local user or system process during power management operations, resulting in a Denial of Service (DoS) due to system instability."], "name": "CVE-2026-31726", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-01T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31726\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31726\nhttps://lore.kernel.org/linux-cve-announce/2026050135-CVE-2026-31726-0cb8@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1444e0568bc2c70868e7b8da5b46fc2252acc3f5,0c00ec409d7b2bce3fcac73188b79a141db7cfda)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4962e5a2f301d24953f17d6748d986e21566abe1,d92d1532e05b1b31d36d48765e43bf73d793d19f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b81ac4395bbeaf36e078dea1a48c02dd97b76235,0587de744615628c38e33ddc1601160a5ea8c50a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b81ac4395bbeaf36e078dea1a48c02dd97b76235,c78e463ee134b4669579d453c81ae00795e4c19a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b81ac4395bbeaf36e078dea1a48c02dd97b76235,8a1128d604c360eca135f15b882b70256a522145)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b81ac4395bbeaf36e78dea1a48c02dd97b76235,1aa9356881ee4ed414bf72d0c56d915492cb5345)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b81ac4395bbeaf36e78dea1a48c02dd97b76235,c038ba56b92e410d1caec22b2dc68780a0b42091)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b81ac4395bbeaf36e78dea1a48c02dd97b76235,eba2936bbe6b752a31725a9eb5c674ecbf21ee7d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "e10735ce87502b07e171727e574afdd6c0890a08"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.18"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.18)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.253,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.203,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.168,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.134,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.81,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.22,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.12,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-01T19:45:23.955139+00:00", "updated": "2026-05-07T18:00:12.975785+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}