Linux Kernel CVE-2026-31722

The f_rndis USB gadget function driver (drivers/usb/gadget/function/f_rndis.c) allocates a net_device during function-instance creation and registers it with the gadget device as its sysfs parent during the bind phase. When the gadget unbinds - for example, during USB cable detach or gadget reconfiguration - the parent gadget device is torn down, but the net_device object survives in memory. This leaves a dangling symbolic link under /sys/class/net/ pointing to a sysfs node that no longer exists, violating the sysfs device tree invariant. The fix applies device_move() to reparent the net_device into the virtual device tree (/sys/devices/virtual) at unbind time, and back under the new gadget on rebind, preserving sysfs topology and power management ordering. CPE data confirms the affected product as cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* across a broad version range introduced at commit f466c6353819326873fa48a02c6f2d7c903240d6. No formal CWE has been assigned, but the root cause most closely resembles CWE-459 (Incomplete Cleanup) - the resource's associated sysfs metadata is not fully cleaned up upon parent teardown. Notably, the assigned tags include 'Information Disclosure,' which conflicts with the provided CVSS vector's C:N (no confidentiality impact); this discrepancy is not resolved by available data and should be verified against the vendor advisory.