CVE-2026-31721: usb: gadget: f_hid: move list and spinlock inits from bind to alloc
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: fhid: move list and spinlock inits from bind to alloc
There was an issue when you did the following: - setup and bind an hid gadget - open /dev/hidg0 - use the resulting fd in EPOLLCTLADD - unbind the UDC - bind the UDC - use the fd in EPOLLCTLDEL
When CONFIGDEBUGLIST was enabled, a listdel corruption was reported within removewaitqueue (via epremovewaitqueue). After some debugging I found out that the queues, which fhid registers via pollwait were the problem. These were initialized using initwaitqueuehead inside hidgbind. So effectively, the bind function re-initialized the queues while there were still items in them.
The solution is to move the initialization from hidgbind to hidgalloc to extend their lifetimes to the lifetime of the function instance.
Additionally, I found many other possibly problematic init calls in the bind function, which I moved as well.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Configuration
Move the list, spinlock, and waitqueue initializations from hidg_bind to hidg_alloc so their lifetimes extend to the lifetime of the function instance.
Linux kernel USB gadget f_hid list, spinlock, and waitqueue initialization location = hidg_alloc
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31721?
The severity of CVE-2026-31721 is classified as high due to potential data exposure via improperly initialized structures.
How do I fix CVE-2026-31721?
To address CVE-2026-31721, ensure you update your Linux kernel to the latest version that resolves this vulnerability.
What versions of the Linux kernel are affected by CVE-2026-31721?
CVE-2026-31721 affects Linux kernels from version 3.19 up to but not including 7.0-rc1.
Can CVE-2026-31721 be exploited remotely?
Yes, CVE-2026-31721 can be exploited remotely if the vulnerable USB gadget is bound and accessible.
What components are specifically impacted by CVE-2026-31721?
CVE-2026-31721 specifically impacts the USB gadget framework, particularly the f_hid component.