Linux Kernel CVE-2026-31725

The vulnerability requires all of the following conditions to be present: (1) Linux kernel compiled with USB gadget support (CONFIG_USB_GADGET=y) and specifically the ECM function enabled (CONFIG_USB_F_ECM=y); (2) the system must be operating in USB device/gadget mode (not standard host mode) with the ECM function loaded and bound; (3) the attacker must have local authenticated access (unprivileged user capable of executing commands and accessing sysfs); (4) the attacker must be able to trigger gadget bind/unbind cycles through sysfs control interfaces or gadget configuration tools; (5) the gadget must be rebound after unbinding to trigger the full vulnerability sequence. This vulnerability does not affect standard desktop or server Linux deployments that operate only in USB host mode. It is specific to embedded systems, Android devices, and specialized configurations using Linux as a USB device. No special kernel configuration beyond standard gadget mode is required if gadget mode itself is enabled.

CVSS score of 5.5 (medium severity) with local attack vector, low complexity, and low privilege requirements indicates moderate real-world risk, but EPSS score of 0.02% (5th percentile) suggests very limited exploitation probability in practice. The vulnerability requires local authenticated access (PR:L) on systems with USB gadget functionality enabled, significantly restricting the attack surface compared to network-exploitable vulnerabilities. The attack vector is local only (AV:L), meaning remote exploitation is not possible. While the CVSS vector indicates denial of service impact (availability impact with no confidentiality or integrity impact), the low EPSS score and absence of active exploitation data suggest this is a low-priority issue despite the medium CVSS rating. This pattern is typical for kernel subsystem bugs affecting specialized functionality - the technical impact is real but exploitation requires specific system configurations (USB gadget mode enabled) that are not prevalent in standard desktop or server deployments. The presence of vendor patches across multiple stable kernel versions confirms the vulnerability is real, but the extremely low EPSS percentile indicates it has not become a widespread exploitation vector.

A local authenticated user on a system running USB gadget mode (e.g., an Android device, embedded system, or virtual machine exposing USB functionality) performs repeated bind and unbind cycles of the ECM gadget function by writing to gadget control interfaces in sysfs or via gadget configuration tools. Each cycle leaves dangling sysfs symlinks that accumulate, and accessing or traversing the sysfs hierarchy triggers kernel issues that crash the system or trigger denial of service conditions. No public exploit code has been identified, suggesting this is primarily a stability/reliability issue rather than an actively exploited vector.