CVE-2026-31725

What it actually does

This is a local availability flaw in the Linux kernel USB gadget Ethernet Control Model (ECM) function. The affected code can leave a network device with an invalid sysfs parent after USB gadget bind/unbind operations, creating dangling sysfs links and incorrect device lifecycle ordering. On systems that use USB gadget networking, a local user with sufficient ability to trigger gadget configuration or bind/unbind cycles may cause kernel device-model inconsistency, network device malfunction, kernel warnings, or potentially a system crash or hang. The impact is availability only; the CVSS vector indicates no confidentiality or integrity impact.

Why it matters to the business

Systems that rely on Linux USB gadget networking—common in embedded devices, development boards, appliances, Android-derived systems, and devices exposing USB Ethernet—may experience loss of USB network connectivity or local denial of service if the vulnerable gadget lifecycle is exercised. The risk is lower than remotely exploitable vulnerabilities because exploitation requires local privileges and a relevant USB gadget configuration, and there is no current KEV listing, ransomware association, or observed EPSS growth. However, kernel availability issues can still be operationally significant for unattended, embedded, or field-deployed devices where reboots or physical recovery are costly.

How an attack unfolds

An attacker first needs local access to a vulnerable Linux system and enough privileges to interact with USB gadget configuration, legacy composite gadget drivers, or bind/unbind paths for an ECM gadget function. The attacker repeatedly creates, binds, unbinds, or rebinds a USB ECM gadget network function such as one exposing a usb0 interface. On vulnerable kernels, the net_device may remain registered while its original gadget parent device is destroyed, leaving stale sysfs topology and invalid device references. Subsequent sysfs access, power-management ordering, rebinding, or network-device operations can trigger inconsistent kernel behavior, resulting in loss of the USB network interface, kernel warnings, or denial of service. No public exploitation maturity is indicated, and the provided EPSS is very low and flat over 30 days.

How to fix it

Update the Linux kernel to a vendor release that includes the upstream fix for the USB gadget f_ecm net_device lifecycle issue. No exact fixed package versions were provided, so use distribution, device-vendor, or kernel-maintainer advisories to identify the corrected kernel build for each affected product line. Where immediate patching is not possible, reduce exposure by disabling unused USB gadget functionality, avoiding ECM gadget configurations on untrusted systems, restricting access to configfs USB gadget controls, preventing unprivileged users from loading gadget-related modules, and limiting local administrative access to devices that can reconfigure USB functions. For embedded products, incorporate the fixed kernel patch into the device firmware branch and validate repeated gadget bind/unbind cycles before release.

How to confirm the fix worked

Confirm the running kernel includes the vendor backport or upstream commit that reparents the ECM net_device correctly across bind and unbind using device_move(). Verify the installed kernel package version against the relevant distribution or device-vendor advisory. On representative test hardware, exercise USB ECM gadget bind, unbind, final unbind, and rebind cycles and confirm that /sys/class/net entries resolve to valid targets and that the network device is correctly reparented between the gadget device tree and /sys/devices/virtual. Review dmesg and journal logs during testing for kernel warnings, use-after-free reports, sysfs errors, device-model warnings, or usb gadget/f_ecm errors. Exposure can also be checked by determining whether USB gadget support and ECM functions are enabled in the kernel and whether /sys/kernel/config/usb_gadget is present and actively configured.

Typical attack path

1. Obtain local access to a Linux system that has USB gadget functionality enabled and includes the vulnerable ECM gadget code.
2. Gain or use privileges sufficient to configure USB gadgets, load/use composite gadget drivers, or trigger gadget bind and unbind operations.
3. Create or activate a USB ECM gadget network function, commonly producing a usb0-style network interface.
4. Unbind, remove, or reconfigure the gadget so that the gadget parent device is destroyed while the network device persists.
5. Repeat bind/unbind or interact with sysfs/network-device paths to trigger dangling sysfs links and device lifecycle inconsistencies.
6. Cause USB network disruption, kernel warnings, a hang, or a crash, resulting in local denial of service.

How to detect it

There are no unique network indicators for exploitation because this is a local kernel/device-lifecycle issue. To assess whether it may have been exploited, review kernel logs, system journals, audit logs, and command history for repeated USB gadget creation, bind, unbind, or teardown operations followed by USB network failures, kernel warnings, device-model errors, hangs, or reboots. Relevant log sources include dmesg, journalctl -k, /var/log/kern.log, /var/log/messages, auditd records for writes under /sys/kernel/config/usb_gadget, and EDR telemetry for processes interacting with configfs or loading gadget modules. Look for repeated manipulation of UDC binding files, ECM function directories, legacy composite gadget drivers, and usb0 interface disappearance or sysfs symlink failures. On systems with crash dumps enabled, inspect vmcore, kdump, pstore, or ramoops artifacts for kernel panics involving USB gadget, f_ecm, net_device, sysfs, or device_move-related call paths. Treat findings as suspicious when repeated gadget reconfiguration is unexpected for the device role or occurs shortly before a kernel crash or service outage.

• /sys/kernel/config/usb_gadget
• /sys/class/net/usb0
• /sys/devices/virtual/net/usb0
• gadget.0/net/usb0
• No such file or directory
• f_ecm
• usb_f_ecm
• ECM
• UDC
• libcomposite
• g_ether
• usb0: unregistering
• kernel: usb
• kernel: gadget
• kernel: f_ecm
• kernel: sysfs
• kernel panic
• Oops
• WARNING: CPU
• KASAN
• dangling sysfs

What your security team should do

• Prioritize patching for embedded, appliance, mobile, kiosk, lab, and industrial systems that actively use Linux USB gadget networking or expose USB Ethernet interfaces.
• Track vendor kernel advisories and deploy the first available fixed kernel or firmware image containing the f_ecm net_device lifecycle correction.
• Restrict local access to USB gadget configuration interfaces such as configfs and require administrative controls for gadget bind/unbind operations.
• Disable unused USB gadget modules or ECM gadget functionality on systems that do not require USB Ethernet device mode.
• Monitor kernel logs for repeated USB gadget bind/unbind activity, dangling sysfs paths, usb0 disappearance, kernel warnings, or panic events around f_ecm/gadget operations.
• For product teams, add regression testing that repeatedly binds and unbinds ECM and legacy composite gadget configurations while checking sysfs link integrity and kernel stability.
• Because the vulnerability is not KEV-listed, not associated with ransomware, and has very low flat EPSS, treat this as a targeted local availability hardening issue rather than an internet-scale emergency unless affected devices are mission-critical.