Linux Kernel CVE-2026-31606

The vulnerable code resides in drivers/usb/gadget/function/f_hid.c, the HID function driver within the Linux kernel USB gadget framework. The gadget framework allows Linux systems to emulate USB devices (keyboards, mice, etc.) toward a USB host. A cdev (character device structure) is used to expose /dev/hidg* nodes to userspace. Prior to the fix, hidg_bind called cdev_init to reinitialize this structure in-place during rebind, even when existing file references - tracked by the kernel's reference counter - remained outstanding from an earlier bind. Reinitializing a cdev with live references is effectively a use-after-reinit condition, consistent with CWE-672 (Operation on Resource After Expiration or Release), causing kernel oopses when stale pointers are dereferenced. The fix replaces cdev_init with cdev_alloc, placing the cdev on the heap so each hidg_bind creates a fresh allocation, and the old one is retained until all references drop to zero. Affected CPE: cpe:2.3:a:linux:linux across multiple stable series confirmed by EUVD data.