CVE-2026-31672

What it actually does

CVE-2026-31672 is a Linux kernel availability flaw in the rt2x00usb Wi-Fi USB driver resource-management path. The driver incorrectly ties a device-managed USB anchor resource to the parent USB device rather than to the USB interface lifetime. When the driver is unbound, reprobed, deferred, or reconfigured without the physical USB device being disconnected, resources may not be released at the correct time. Repeated triggering can leak kernel resources and potentially exhaust memory or destabilize networking/kernel availability. The CVSS vector indicates local access with low privileges, no user interaction, and high availability impact, with no expected confidentiality or integrity impact.

Why it matters to the business

Systems using affected Linux kernels with rt2x00usb-supported USB Wi-Fi adapters may experience degraded wireless networking, kernel memory pressure, service interruption, or system instability if the driver lifecycle is repeatedly exercised. The practical risk is lower than remotely exploitable vulnerabilities because exploitation requires local access and a relevant hardware/driver configuration; EPSS is very low and there is no known KEV listing or public exploit maturity. However, for embedded, kiosk, lab, OT, or remote-access systems that depend on USB Wi-Fi for connectivity, an availability failure could cause operational downtime or require manual recovery.

How an attack unfolds

An attacker first needs local access to a Linux system where an affected kernel is running and an rt2x00usb-family USB wireless adapter is present or the vulnerable module can be loaded. The attacker then repeatedly causes driver lifecycle transitions, such as unbinding and rebinding the USB interface, triggering probe deferral paths, changing device configuration, or otherwise forcing the rt2x00usb driver to detach without physically removing the parent USB device. Because the USB anchor resource is associated with the wrong lifetime, cleanup does not occur when the interface driver is unbound. Repetition can accumulate unreleased kernel resources. Over time this may lead to memory pressure, wireless device malfunction, kernel warnings, out-of-memory activity, or a denial of service requiring service restart, module reload, or reboot. There is no indication from the provided data that this vulnerability is being used by known threat actors or ransomware campaigns.

How to fix it

Update the Linux kernel to a vendor release that includes the rt2x00usb devres lifetime fix for this issue. Because no exact fixed versions were provided, use the relevant distribution or appliance vendor advisory to identify the first patched kernel package for the deployed branch. Prioritize systems that use USB Wi-Fi adapters supported by rt2x00usb/rt2800usb and systems where local users, untrusted workloads, or automation can manipulate USB driver binding. If immediate patching is not possible, reduce exposure by disabling or blacklisting the vulnerable USB Wi-Fi driver modules where they are not required, removing unused USB Wi-Fi hardware, restricting local access to sysfs driver bind/unbind controls, limiting module-loading privileges, and monitoring for repeated USB Wi-Fi driver resets or OOM conditions. Rebooting may be required after kernel upgrade to ensure the patched kernel is running.

How to confirm the fix worked

Confirm remediation by verifying the running kernel version, not only the installed package version, and mapping it to the vendor advisory that contains the rt2x00usb fix. Check whether affected modules are present or loaded using commands such as `lsmod | grep -E 'rt2x00usb|rt2800usb|rt2x00lib'` and inspect connected USB Wi-Fi devices with `lsusb` and `/sys/bus/usb/drivers/`. After patching, validate that the host has booted into the fixed kernel with `uname -r` and that package management reports the corrected kernel build. For high-assurance validation, perform controlled driver unbind/rebind testing in a non-production environment while monitoring `dmesg`, kernel memory usage, slab growth, and OOM events to confirm resources are released correctly. Exposure is limited or absent on systems that do not run the affected driver and do not support or attach rt2x00usb-family USB Wi-Fi devices.

Typical attack path

1. Gain local access to a Linux host, container escape context, privileged service context, or interactive account with sufficient ability to influence USB driver binding or device configuration.
2. Identify that an rt2x00usb-supported USB Wi-Fi adapter and vulnerable Linux kernel are present.
3. Load or interact with the rt2x00usb/rt2800usb driver stack if it is not already active.
4. Repeatedly trigger USB interface unbind/rebind, reprobe, configuration changes, or probe-deferral-like conditions without physically disconnecting the USB device.
5. Cause kernel-managed USB anchor resources to remain allocated beyond the intended interface lifetime.
6. Continue the loop until resource leakage results in memory pressure, driver failure, wireless connectivity loss, OOM activity, or broader system instability.

How to detect it

To determine whether this was already exploited or triggered, review host-level telemetry rather than network logs, because exploitation is local and involves kernel driver lifecycle events. Primary sources include `dmesg`, `journalctl -k`, `/var/log/kern.log`, `/var/log/messages`, auditd logs for writes to sysfs driver bind/unbind paths, EDR process telemetry, shell history for administrative commands, and kernel OOM or memory-pressure records. Look for repeated rt2x00usb/rt2800usb driver bind, unbind, probe, disconnect, reset, or firmware initialization messages followed by increasing memory pressure, slab growth, OOM-killer activity, wireless interface disappearance, or host instability. Investigate local processes repeatedly writing to `/sys/bus/usb/drivers/*/unbind` or `/sys/bus/usb/drivers/*/bind`, running `modprobe`, `rmmod`, or `modprobe -r` against rt2x00-related modules, or restarting network/USB subsystems in tight loops. Because the vulnerability is a resource-lifetime bug, there may be no unique exploit artifact; detection should focus on abnormal frequency, timing correlation, and whether the activity was initiated by expected administrative tooling.

• rt2x00usb
• rt2800usb
• rt2x00lib
• /sys/bus/usb/drivers/rt2800usb/unbind
• /sys/bus/usb/drivers/rt2800usb/bind
• /sys/bus/usb/drivers/rt2x00usb/unbind
• /sys/bus/usb/drivers/rt2x00usb/bind
• modprobe rt2800usb
• modprobe -r rt2800usb
• rmmod rt2800usb
• modprobe rt2x00usb
• modprobe -r rt2x00usb
• rmmod rt2x00usb
• Out of memory
• oom-killer
• Killed process
• USB disconnect
• reset high-speed USB device
• device descriptor read
• probe failed

What your security team should do

• Inventory Linux systems using USB Wi-Fi adapters and identify hosts with rt2x00usb, rt2800usb, or related rt2x00 modules loaded.
• Patch affected Linux kernels through the appropriate distribution or vendor channel and reboot into the fixed kernel.
• Prioritize remediation for systems where local users or untrusted workloads can access sysfs, load modules, reconfigure USB devices, or repeatedly restart network hardware.
• Temporarily blacklist or unload rt2x00usb-related modules on systems that do not require those USB Wi-Fi adapters.
• Restrict permissions and administrative workflows that allow USB driver unbind/rebind or module loading by non-administrative users.
• Monitor kernel logs for repeated rt2x00usb/rt2800usb bind/unbind activity, USB wireless resets, memory leaks, and OOM-killer events.
• For embedded or remote systems dependent on USB Wi-Fi, schedule maintenance carefully and verify out-of-band recovery options before patching or driver changes.