Linux Kernel CVE-2026-31606

Exploitation requires two non-default conditions to be simultaneously true: (1) the Linux system must be explicitly configured as a USB HID gadget using the kernel gadget framework - this is not a default configuration on any mainstream Linux distribution and requires deliberate setup via configfs or a gadget configuration script, typically found only on embedded devices (Raspberry Pi, BeagleBone, custom IoT hardware) or developer workstations emulating USB HID peripherals; and (2) a /dev/hidg* character device node must be actively open by at least one userspace process at the precise moment a USB gadget unbind/rebind cycle is triggered. The CVSS vector (PR:L) confirms that holding the file descriptor requires only low-privilege local access, though triggering the rebind itself typically requires elevated privileges or a system event. Systems not running the USB gadget stack - including the vast majority of servers, desktops, and cloud VMs - are completely unaffected regardless of privilege level.

The CVSS 5.5 Medium score (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) accurately reflects a local-only, availability-only impact. Real-world risk is further constrained by EPSS at 0.02% (5th percentile) - one of the lowest exploitation-likelihood tiers - and the absence of any KEV listing or known public exploit. The 'Information Disclosure' tag in the metadata conflicts with the CVSS vector's C:N (no confidentiality impact) and the description, which describes only kernel oopses; this tag likely reflects downstream distribution tagging conventions and should not be treated as a confirmed secondary impact. The attack surface is narrow: only systems explicitly configured as USB HID gadgets (a non-default configuration requiring intentional setup via the gadget framework, typically on embedded hardware) are reachable. On standard server, desktop, or cloud Linux deployments where the USB gadget stack is not configured, this vulnerability is entirely unexploitable. Overall, this is a low-urgency patch for general-purpose Linux environments but a medium-priority fix for embedded/IoT product teams shipping HID gadget-enabled Linux builds.

On an embedded Linux device (such as a Raspberry Pi or custom IoT hardware) configured as a USB HID gadget, a low-privileged local process opens /dev/hidg0 and holds the file descriptor open. A system management process or administrator subsequently triggers a USB gadget reconfiguration via configfs, causing an unbind/rebind cycle. During hidg_bind, the legacy cdev_init call reinitializes the character device structure in-place while the low-privileged process's reference count is still non-zero, corrupting kernel state and producing a kernel oops that crashes the system. No public exploit code exists at time of analysis.