Skip to main content

Linux Kernel EUVDEUVD-2026-26534

| CVE-2026-31721 MEDIUM
2026-05-01 Linux
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.7 MEDIUM

AC:H reflects the precise sequence required: gadget active, fd in epoll, and UDC rebind triggered; PR:L for the opening process, no confidentiality or integrity impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

7
Analysis Generated
Jul 24, 2026 - 01:18 vuln.today
CVSS changed
May 06, 2026 - 21:07 NVD
5.5 (MEDIUM)
Patch available
May 01, 2026 - 16:02 EUVD
Patch released
May 01, 2026 - 15:24 nvd
Patch available
EUVD ID Assigned
May 01, 2026 - 15:00 euvd
EUVD-2026-26534
CVE Published
May 01, 2026 - 14:14 nvd
MEDIUM 5.5
CVE Published
May 01, 2026 - 14:14 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_hid: move list and spinlock inits from bind to alloc

There was an issue when you did the following:

  • setup and bind an hid gadget
  • open /dev/hidg0
  • use the resulting fd in EPOLL_CTL_ADD
  • unbind the UDC
  • bind the UDC
  • use the fd in EPOLL_CTL_DEL

When CONFIG_DEBUG_LIST was enabled, a list_del corruption was reported within remove_wait_queue (via ep_remove_wait_queue). After some debugging I found out that the queues, which f_hid registers via poll_wait were the problem. These were initialized using init_waitqueue_head inside hidg_bind. So effectively, the bind function re-initialized the queues while there were still items in them.

The solution is to move the initialization from hidg_bind to hidg_alloc to extend their lifetimes to the lifetime of the function instance.

Additionally, I found many other possibly problematic init calls in the bind function, which I moved as well.

AnalysisAI

List corruption in the Linux kernel's USB HID gadget driver (f_hid) can crash systems configured with USB gadget functionality. When a user-space process opens /dev/hidg0, registers the file descriptor with epoll, and the UDC (USB Device Controller) is subsequently unbound and rebound, the hidg_bind() function re-initializes wait queues that still contain registered waiters - corrupting the kernel's internal list structures and triggering an availability-impacting kernel panic upon epoll removal. The vulnerability carries a CVSS score of 5.5 (Medium), EPSS of 0.02% (7th percentile), is not listed in CISA KEV, and no public exploit code has been identified at time of analysis.

Technical ContextAI

The flaw resides in drivers/usb/gadget/function/f_hid.c within the Linux kernel's USB gadget framework. The f_hid function exposes HID (Human Interface Device) emulation over USB via /dev/hidgN character devices. Two wait queues - used to signal readable/writable state to user-space pollers - were initialized via init_waitqueue_head() inside hidg_bind(), the function called each time a UDC is bound. If a file descriptor is registered with the Linux epoll subsystem (EPOLL_CTL_ADD) while the gadget is bound, and the UDC is then unbound and rebound, hidg_bind() re-initializes the wait queues in-place while poll_wait() waiters are still enqueued. The subsequent EPOLL_CTL_DEL triggers ep_remove_wait_queue → remove_wait_queue, which calls list_del on an element whose list head has been clobbered by the re-initialization. With CONFIG_DEBUG_LIST enabled this manifests as a detectable list_del corruption; without it, silent memory corruption or a kernel oops may occur. The fix moves all relevant initialization calls from hidg_bind() to hidg_alloc(), tying the lifetime of wait queues to the function instance rather than the bind/unbind cycle. CPE string cpe:2.3:a:linux:linux identifies the Linux kernel as the sole affected product.

RemediationAI

Upgrade to a patched Linux kernel version: mainline 7.0, or stable branch releases 6.19.12, 6.18.22, 6.12.81, 6.6.135, 6.1.169, 5.15.203, or 5.10.253. The upstream fix is available across eight stable-branch commits at git.kernel.org/stable (see references). Ubuntu users should apply the kernel update referenced in USN-8567-1 at https://ubuntu.com/security/notices/USN-8567-1. Red Hat and SUSE users should monitor their respective errata channels for kernel updates incorporating these upstream commits. If patching is not immediately possible, a specific compensating control is to avoid registering /dev/hidgN file descriptors with epoll on systems that perform UDC bind/unbind operations; alternatively, disable the f_hid USB gadget module (modprobe -r usb_f_hid) if HID gadget emulation is not required - this eliminates the attack surface entirely with no functional impact on non-gadget deployments.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

EUVD-2026-26534 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy