CVE-2026-31722

What it actually does

This is a local availability flaw in the Linux kernel USB gadget RNDIS function. The vulnerable code incorrectly manages the lifecycle and sysfs parentage of a net_device created for USB RNDIS networking across gadget bind and unbind operations. When the USB gadget function is unbound, the parent gadget device can be destroyed while the network device remains registered, leaving dangling sysfs links and incorrect device topology. In affected kernels, repeated bind/unbind or gadget reconfiguration activity can corrupt device lifecycle assumptions and potentially trigger kernel warnings, crashes, or other denial-of-service behavior affecting system availability.

Why it matters to the business

Systems that expose or manage Linux USB gadget functionality, especially embedded devices, appliances, development boards, Android-derived systems, USB-connected networking devices, and products using RNDIS over USB, may be susceptible to local disruption. A successful attack could cause device instability, loss of USB networking, service interruption, or a system crash requiring reboot or physical recovery. The currently reported exploitation likelihood is low, with no known CISA KEV listing, no ransomware association, no public exploit maturity, and a stable low EPSS score, so remediation should be prioritized based on whether USB gadget/RNDIS functionality is enabled in production.

How an attack unfolds

An attacker first needs local access with enough privileges to influence USB gadget configuration, load or use the RNDIS gadget function, or trigger bind and unbind cycles through configfs, gadget drivers, or device-specific management interfaces. The attacker configures or exercises an affected USB RNDIS gadget interface, causing a net_device such as usb0 to be registered beneath the gadget device tree. They then trigger unbind, teardown, or reconfiguration of the USB gadget. In vulnerable kernels, the gadget parent device may be destroyed while the network device remains alive, leaving a stale sysfs relationship. Repeating this sequence or combining it with power-management or network-device operations can cause inconsistent kernel object state, leading to loss of the USB network interface, kernel warnings, or a system availability failure such as a crash or hang.

How to fix it

Upgrade to a Linux kernel build that includes the upstream fix for the USB gadget f_rndis net_device lifecycle issue. Because no exact fixed package versions were provided, use the latest vendor-supported kernel for the affected distribution, appliance, embedded BSP, Android-derived tree, or long-term-support kernel branch and verify that it contains the patch that reparents the RNDIS net_device using device_move() across bind and unbind cycles. Where immediate patching is not possible, reduce exposure by disabling unused USB gadget functionality, disabling the RNDIS gadget function if not required, restricting access to configfs USB gadget configuration paths, preventing untrusted local users from loading gadget modules or changing gadget composition, and limiting physical or management access that can trigger USB gadget reconfiguration.

How to confirm the fix worked

Confirm the running kernel includes the vendor fix or an equivalent backport for the f_rndis device lifecycle change. Validate package state with distribution tooling and compare the installed kernel build against vendor advisories. On systems that use USB gadget RNDIS, test controlled bind and unbind cycles and verify that sysfs topology remains consistent: network interfaces such as usb0 should not point to missing gadget-device paths after unbind. Check that /sys/class/net entries do not contain dangling symlinks to removed gadget devices. Review kernel logs during testing for USB gadget, RNDIS, net_device, sysfs, reference-counting, warning, oops, or panic messages. If RNDIS is not required, validate that the relevant gadget function is disabled and cannot be configured by untrusted local users.

Typical attack path

1. Obtain local access to a Linux system that uses USB gadget functionality or RNDIS networking.
2. Gain sufficient privileges to configure, bind, unbind, or reconfigure USB gadget functions.
3. Create or activate an RNDIS USB gadget network interface, commonly resulting in an interface such as usb0.
4. Trigger gadget unbind, teardown, disconnect, or reconfiguration while the RNDIS network device remains registered.
5. Repeat bind/unbind or reconfiguration cycles to increase the chance of hitting the lifecycle bug.
6. Cause USB networking failure, kernel instability, or a denial-of-service condition.

How to detect it

To determine whether this was already exploited or triggered, review kernel logs, persistent journal data, crash dumps, watchdog reset records, and device-management logs for USB gadget RNDIS bind/unbind activity followed by USB networking loss, kernel warnings, oopses, panics, hangs, or unexpected reboots. Focus on systems with RNDIS gadget interfaces such as usb0 and evidence of frequent gadget reconfiguration through configfs or legacy composite gadget drivers. Check sysfs after suspected events for dangling /sys/class/net links that point to removed gadget-device paths. On systems with crash collection enabled, inspect vmcore, pstore, ramoops, kdump, or vendor crash artifacts for call traces involving f_rndis, USB gadget composite code, net_device registration/unregistration, sysfs, kobject lifecycle, or device_move-related paths. There are no known public threat actors or ransomware campaigns tied to this vulnerability, so detection should emphasize local misuse, instability patterns, and forensic evidence of repeated gadget teardown/rebind sequences rather than external network indicators.

• /sys/class/net/usb0
• /sys/devices/platform/*/gadget.0/net/usb0
• f_rndis
• rndis
• usb_f_rndis
• g_ether
• g_multi
• libcomposite
• /sys/kernel/config/usb_gadget/
• No such file or directory
• gadget.0/net/usb0
• unregister_netdevice
• register_netdevice
• net_device
• usb0
• Oops
• kernel panic
• WARNING: CPU
• Unable to handle kernel
• BUG: kernel NULL pointer dereference

What your security team should do

• Inventory Linux systems, embedded devices, appliances, and development platforms that enable USB gadget mode or RNDIS USB networking.
• Prioritize patching systems where USB gadget configuration is exposed to local users, device-management interfaces, containerized workloads with elevated privileges, or physical attackers.
• Apply the latest vendor-supported kernel update or product firmware containing the f_rndis net_device lifecycle fix.
• Disable RNDIS or USB gadget functions where they are not operationally required.
• Restrict write access to USB gadget configfs paths and prevent untrusted users from loading or unloading USB gadget modules.
• Monitor kernel logs for repeated USB gadget bind/unbind activity, dangling sysfs paths, net_device lifecycle warnings, oopses, or unexplained reboots.
• For embedded products, include repeated USB gadget reconfiguration and disconnect/reconnect tests in regression validation.
• Because this issue is not currently listed in KEV, has no known ransomware use, and has very low EPSS, handle it as defense-in-depth unless affected devices expose the vulnerable functionality in high-risk environments.