Linux Kernel CVE-2026-31723

Local authenticated access (PR:L per CVSS vector) with ability to write to USB gadget configuration in /sys/kernel/config/usb_gadget is required. The f_subset gadget function must be enabled in the kernel and the gadget must be configured with a network device. The vulnerability is triggered by unbinding and rebinding the gadget function, which is restricted to local users with write permissions to gadget sysfs paths. Systems with USB gadget mode disabled or without local administrative access are not at risk. The vulnerability does not affect systems using only standard USB host mode or those without gadget subsystem enabled.

The CVSS 5.5 score reflects a local attack vector requiring low privileges (PR:L) with no user interaction (UI:N), causing availability impact (A:H) but no confidentiality or integrity impact. The extremely low EPSS score of 0.02% (5th percentile) indicates minimal real-world exploitation probability despite the moderate CVSS rating, suggesting this is primarily a data structure corruption issue rather than a practically exploitable attack vector. The vulnerability requires local system access and the ability to trigger gadget bind/unbind cycles, limiting exposure to system administrators or developers with USB gadget capabilities. The KEV status is unknown from provided data, but the vulnerability is a sysfs state corruption issue unlikely to enable privilege escalation or remote compromise. The discrepancy between CVSS and EPSS suggests defenders should deprioritize this below the base score might indicate - actual exploitation requires specific gadget configurations and local access patterns.

A local user with gadget administrator privileges unbinds a USB gadget function by removing it from the gadget composition, leaving orphaned sysfs symlinks. The user then queries /sys/class/net/usb0, triggering sysfs operations against the dangling reference, causing kernel memory access violations. Repeated bind/unbind cycles corrupt the sysfs device tree state, potentially affecting USB network functionality or causing denial of service on systems managing multiple gadget functions.