Skip to main content

Linux Kernel CVE-2026-31756

| EUVDEUVD-2026-26569 MEDIUM
Improper Locking (CWE-667)
2026-05-01 Linux
Red Hat Suse Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

7
Analysis Generated
May 08, 2026 - 21:00 vuln.today
CVSS changed
May 08, 2026 - 18:37 NVD
5.5 (MEDIUM)
Patch available
May 01, 2026 - 16:33 EUVD
Patch released
May 01, 2026 - 15:24 nvd
Patch available
EUVD ID Assigned
May 01, 2026 - 15:00 euvd
EUVD-2026-26569
CVE Published
May 01, 2026 - 14:14 nvd
MEDIUM 5.5
CVE Published
May 01, 2026 - 14:14 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop()

dwc2_gadget_exit_clock_gating() internally calls call_gadget() macro, which expects hsotg->lock to be held since it does spin_unlock/spin_lock around the gadget driver callback invocation.

However, dwc2_hsotg_udc_stop() calls dwc2_gadget_exit_clock_gating() without holding the lock. This leads to:

  • spin_unlock on a lock that is not held (undefined behavior)
  • The lock remaining held after dwc2_gadget_exit_clock_gating() returns,

causing a deadlock when spin_lock_irqsave() is called later in the same function.

Fix this by acquiring hsotg->lock before calling dwc2_gadget_exit_clock_gating() and releasing it afterwards, which satisfies the locking requirement of the call_gadget() macro.

AnalysisAI

Denial of service in Linux kernel USB dwc2 gadget driver allows local authenticated users to trigger a deadlock via improper spin lock handling in dwc2_hsotg_udc_stop(). The vulnerability stems from a locking protocol violation where dwc2_gadget_exit_clock_gating() expects a held lock but is called without one, causing spin_unlock on an unheld lock followed by a lock held indefinitely, resulting in system hang. No public exploit code identified at time of analysis.

Technical ContextAI

The Linux kernel USB Synopsys DesignWare Core High-Speed (dwc2) gadget controller driver implements USB peripheral device functionality. The vulnerability exists in the gadget mode stop sequence (dwc2_hsotg_udc_stop() function) where proper spinlock synchronization is not maintained. The call_gadget() macro internally performs spin_unlock/spin_lock pairs around gadget driver callbacks, expecting the caller to already hold hsotg->lock. When dwc2_gadget_exit_clock_gating() - which uses call_gadget() - is invoked without the lock being held, it violates this contract, causing undefined behavior in the synchronization primitive and subsequent deadlock. The root cause is classified under CWE-667 (Improper Locking), a synchronization primitive misuse pattern.

RemediationAI

Vendor-released patches are available across all supported stable kernel series: upgrade to Linux 5.15.203 or later (5.15.x), 6.1.168 or later (6.1.x), 6.6.134 or later (6.6.x), 6.12.81 or later (6.12.x), 6.18.22 or later (6.18.x), 6.19.12 or later (6.19.x), or 7.0 or later. The fix acquires hsotg->lock before calling dwc2_gadget_exit_clock_gating() and releases it afterward, ensuring the locking invariant of call_gadget() is maintained. For systems unable to immediately upgrade, disable USB gadget functionality if not required by the device (this prevents dwc2_hsotg_udc_stop() from being called), or restrict local access to USB device management interfaces if supported by your distribution. Verify that your system uses the dwc2 gadget driver (typically on embedded systems or devices with USB OTG support) before treating as critical priority; standard desktop and server distributions without USB gadget mode enabled face minimal practical risk.

Same weakness CWE-667 – Improper Locking

View all
CVE-2025-43510 HIGH POC
7.8
CVE-2019-5886 CRITICAL POC
9.8
CVE-2020-13246 HIGH POC
7.5
CVE-2019-15513 HIGH POC
7.5
CVE-2019-11599 HIGH POC
7.0
CVE-2023-21400 MEDIUM POC
6.7
CVE-2021-20291 MEDIUM POC
6.5
CVE-2020-12658 CRITICAL
9.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-31756 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy