CVE-2026-31723

What it actually does

This is a local Linux kernel availability flaw in the USB gadget networking code, specifically the f_subset USB gadget function. The issue is caused by incorrect net_device lifecycle handling when a USB gadget network interface is bound, unbound, and rebound. The network device can survive after its parent gadget device is destroyed, leaving dangling sysfs references and inconsistent device topology. Under the right local conditions, this can lead to kernel instability, device-management failures, or a denial of service affecting USB gadget networking and potentially system availability. The CVSS vector indicates local access with low complexity and low privileges, no user interaction, and high availability impact, with no direct confidentiality or integrity impact.

Why it matters to the business

Systems that rely on Linux USB gadget networking, such as embedded devices, appliances, development boards, phones, IoT devices, or systems exposing USB Ethernet-style interfaces, may experience crashes, degraded device behavior, or loss of USB networking functionality if the vulnerable path is triggered. Because exploitation requires local access and there is no known public exploit or CISA KEV listing, broad internet-scale risk is low; however, the operational impact can still be meaningful for devices where USB gadget networking is part of provisioning, diagnostics, management, or production workflows.

How an attack unfolds

An attacker with local access to a vulnerable Linux system would first need the ability to interact with or influence USB gadget configuration, such as through configfs, gadget drivers, or workflows that repeatedly bind and unbind USB gadget network functions. The attacker triggers lifecycle transitions involving the affected f_subset network function so that the gadget device is destroyed while the associated net_device remains registered. This creates stale sysfs topology and invalid parent-child device relationships. Repeated manipulation of the gadget bind and unbind process may cause kernel device-management errors, resource lifecycle inconsistencies, or a crash, resulting in denial of service. There are no indications from the provided intelligence that this vulnerability is being exploited by named threat actors, ransomware campaigns, or public exploit tooling.

How to fix it

Apply a Linux kernel update that includes the upstream fix for the USB gadget f_subset net_device lifecycle issue. Because no exact fixed versions were provided, use the corrected kernel packages supplied by the relevant Linux distribution, device vendor, Android/device BSP vendor, or long-term stable kernel branch. Prioritize systems that enable USB gadget mode, USB Ethernet/RNDIS-style gadget networking, configfs-based gadget composition, or embedded USB device functionality. If immediate patching is not possible, reduce exposure by disabling unused USB gadget networking functions, restricting local users from modifying USB gadget configuration, limiting access to configfs and related gadget-management interfaces, and disabling unnecessary gadget drivers/modules where operationally feasible.

How to confirm the fix worked

Confirm remediation by verifying that the running kernel version includes the vendor or upstream patch for this issue, not merely that a package is installed. On affected device classes, test repeated USB gadget bind, unbind, and rebind operations and confirm that the network interface is correctly reparented between the gadget device tree and /sys/devices/virtual without leaving dangling /sys/class/net links. Inspect sysfs after unbinding and rebinding USB gadget networking; /sys/class/net/usb* entries should resolve to existing targets. Review kernel logs during validation for warnings, oopses, use-after-free symptoms, sysfs errors, or device lifecycle failures related to USB gadget networking.

Typical attack path

1. Obtain local access to a Linux system that supports USB gadget networking.
2. Confirm that USB gadget functionality and the affected networking function are available or loaded.
3. Create or manipulate a USB gadget configuration that uses the affected subset networking function.
4. Repeatedly bind, unbind, or rebind the gadget device to trigger net_device parent lifecycle inconsistencies.
5. Cause stale sysfs references, device-management errors, or kernel instability.
6. Disrupt USB gadget networking or system availability.

How to detect it

To assess whether this was already triggered, review kernel logs, system journals, crash dumps, and device-management logs for USB gadget networking errors around times when USB gadget interfaces were created, removed, rebound, or when USB cables were connected or disconnected. Useful log sources include dmesg, journald, /var/log/kern.log, /var/log/messages, persistent pstore/ramoops logs on embedded systems, crash/kdump vmcores, and gadget-management service logs. Look for repeated bind/unbind activity involving USB gadget network interfaces such as usb0, stale sysfs links under /sys/class/net, missing gadget net paths, kernel warnings or oopses involving usb_f_subset, libcomposite, configfs, net_device registration, device_move, or sysfs parent handling. Because exploitation is local and may only cause instability, absence of a distinctive artifact does not prove absence of attempted exploitation; correlate suspicious local gadget reconfiguration activity with crashes, watchdog resets, or loss of USB networking.

• /sys/class/net/usb0
• /sys/devices/virtual/net/usb0
• /sys/devices/platform/*/gadget.0/net/usb0
• gadget.0/net/usb0: No such file or directory
• usb_f_subset
• f_subset
• libcomposite
• configfs-gadget
• /sys/kernel/config/usb_gadget/
• usb0
• device_move
• net_device
• dangling sysfs symlink
• gadget.0/net/usb0

What your security team should do

• Inventory Linux systems, embedded devices, appliances, and mobile/IoT platforms that enable USB gadget networking or expose USB Ethernet-style gadget interfaces.
• Prioritize patching devices where local users, field technicians, kiosks, debug ports, or attached hosts can influence USB gadget configuration.
• Apply vendor kernel updates that include the USB gadget f_subset lifecycle fix; if using custom kernels, backport the upstream patch and rebuild.
• Temporarily disable unused USB gadget functions or restrict access to configfs-based gadget configuration until patched.
• Monitor kernel logs on high-risk devices for USB gadget, sysfs, and net_device lifecycle errors, especially after USB connect/disconnect or provisioning activity.
• Include repeated gadget bind/unbind regression testing in validation for embedded or appliance firmware releases.
• Because EPSS is very low and no KEV or ransomware association is reported, treat this as a targeted local availability risk rather than an emergency internet-facing exposure.