CVE-2026-31721

What it actually does

This is a local denial-of-service flaw in the Linux kernel USB gadget HID function driver, f_hid. The bug occurs because wait queues, lists, spinlocks, and related state were initialized during gadget bind instead of during function allocation, allowing those structures to be reinitialized while still referenced by an open /dev/hidg* file descriptor and epoll. A local user able to interact with HID gadget device nodes and trigger USB Device Controller bind/unbind activity can corrupt kernel list state during epoll cleanup, potentially causing a kernel warning, BUG, panic, or system instability. The impact is availability only; the supplied CVSS vector does not indicate confidentiality or integrity impact.

Why it matters to the business

Affected Linux systems that use USB gadget HID functionality, especially embedded devices, appliances, development boards, and products that expose HID gadget interfaces, may be locally crashed or destabilized. Exploitation requires local access and a specific USB gadget configuration sequence, and current public risk signals are low: EPSS is 0.00123 with no 30-day increase, it is not listed in CISA KEV, and no exploit maturity is reported. Organizations should still patch affected kernels during normal maintenance cycles or sooner where untrusted local users, containers, plugins, or applications can access USB gadget interfaces.

How an attack unfolds

An attacker first needs local execution on a Linux system with USB gadget HID support enabled and an HID gadget configured. They open the HID gadget device, such as /dev/hidg0, and register the resulting file descriptor with epoll. The attacker then causes or waits for the USB Device Controller to be unbound and rebound, which invokes the vulnerable bind path and reinitializes queue/list state that may still contain epoll wait queue entries. When the attacker later removes the file descriptor from epoll or otherwise causes epoll cleanup, the kernel attempts to remove a wait queue entry from corrupted or reinitialized list state. On debug kernels this may appear as a list_del corruption report in remove_wait_queue via ep_remove_wait_queue; on production kernels it may result in a kernel panic, crash, or other availability failure.

How to fix it

Upgrade to a kernel version or vendor kernel package that includes the upstream fix moving f_hid list, spinlock, and wait queue initialization from hidg_bind to hidg_alloc. No exact fixed package versions were provided in the input, so use distribution or device-vendor advisories for the applicable fixed kernel builds. Where immediate patching is not possible, reduce exposure by disabling unused USB gadget HID functionality, unloading or blacklisting the f_hid/USB gadget HID module where feasible, restricting access to /dev/hidg* device nodes, limiting who can modify USB gadget configuration through configfs, and preventing untrusted local users or containers from controlling USB Device Controller bind/unbind operations.

How to confirm the fix worked

Confirm remediation by verifying that the running kernel package or source tree contains the f_hid fix that initializes relevant queues, lists, and spinlocks during function allocation rather than bind. Check vendor changelogs for the patch titled similarly to "usb: gadget: f_hid: move list and spinlock inits from bind to alloc." Validate runtime exposure by checking whether USB gadget HID support is enabled, whether /dev/hidg* nodes exist, and whether untrusted users can access those nodes or USB gadget configfs controls. In a controlled non-production test only, repeat the described open, epoll add, UDC unbind/rebind, and epoll delete sequence and confirm that no kernel warnings, list corruption messages, oops, or panic occur.

Typical attack path

1. Gain local code execution on a Linux system with USB gadget HID functionality enabled.
2. Confirm that an HID gadget device node such as /dev/hidg0 is present and accessible.
3. Open the HID gadget device and keep the file descriptor alive.
4. Add the file descriptor to an epoll instance using EPOLL_CTL_ADD.
5. Trigger or race a USB Device Controller unbind and bind operation for the HID gadget.
6. Remove the same file descriptor from epoll using EPOLL_CTL_DEL or otherwise force epoll cleanup.
7. Cause kernel list corruption in the f_hid wait queue path, resulting in a crash, panic, or service disruption.

How to detect it

Look for evidence of prior exploitation or attempted triggering in kernel logs, persistent journal logs, crash dumps, and system reboot records. Useful sources include dmesg, journalctl -k, /var/log/kern.log, /var/log/messages, /var/log/syslog, kdump/vmcore artifacts, pstore/ramoops, and watchdog or unexpected reboot telemetry. Focus on messages around USB gadget HID activity, UDC unbind/bind events, epoll cleanup, list corruption, kernel oopses, BUG splats, panics, or crashes involving f_hid, remove_wait_queue, or ep_remove_wait_queue. Because the vulnerability is a local denial-of-service and has no known public exploitation or KEV status, absence of network indicators is expected; detection depends primarily on host kernel telemetry and crash artifacts.

• /dev/hidg0
• /dev/hidg1
• list_del corruption
• remove_wait_queue
• ep_remove_wait_queue
• f_hid
• hidg_bind
• hidg_alloc
• CONFIG_DEBUG_LIST
• kernel BUG
• kernel panic
• Oops:
• Unable to handle kernel
• UDC
• EPOLL_CTL_ADD
• EPOLL_CTL_DEL
• usb: gadget: f_hid

What your security team should do

• Inventory Linux systems that enable USB gadget mode or expose HID gadget devices such as /dev/hidg0, prioritizing embedded, appliance, kiosk, lab, and development-board environments.
• Patch affected kernels using vendor-provided fixed builds when available; if exact fixed versions are unclear, confirm inclusion of the f_hid allocation-time initialization patch.
• Restrict local access to /dev/hidg* and USB gadget configfs controls to trusted administrative users only.
• Disable or remove USB gadget HID support on systems that do not require it.
• Add monitoring for kernel log messages indicating list corruption, remove_wait_queue failures, ep_remove_wait_queue traces, f_hid errors, kernel oopses, or unexpected reboots.
• Treat systems with untrusted local users, containers with device access, or application plugins that can access USB gadget devices as higher priority despite the low EPSS and lack of KEV listing.