Linux Kernel EUVD-2026-26535

Exploitation requires local access with at minimum low-privilege user rights on a Linux system where the USB gadget f_rndis (RNDIS over USB) function is actively configured and in use - this is a non-default configuration almost exclusively found on embedded devices, mobile platforms, or single-board computers acting as USB gadget hosts. The vulnerability manifests during USB gadget unbind events, which may be triggered by physical USB disconnection, gadget reconfiguration, or administrative unbind. Standard server, desktop, or cloud VM deployments do not load the usb_f_rndis module and are not affected. Exploitation is limited by: the AV:L (local) attack vector ruling out remote exploitation; the PR:L requirement excluding unauthenticated attackers; and the highly specific deployment mode (USB gadget RNDIS) that is absent from the vast majority of production Linux systems. The 'Information Disclosure' tag remains unresolved against the C:N CVSS metric - if a confidentiality path exists via sysfs path exposure, exploitation conditions for that vector are not confirmed by available data.

The CVSS 3.1 base score of 5.5 (Medium) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H accurately reflects a locally exploitable, low-complexity availability impact. Attack vector is local, meaning remote exploitation is not possible. Low privileges are required, reducing the exploitable population. EPSS at 0.02% and 5th percentile confirms very low exploitation probability - this is not a vulnerability attracting active attacker tooling. The vulnerability is absent from the CISA KEV catalog and no public proof-of-concept has been identified. The practical risk surface is further constrained by the requirement for USB gadget RNDIS configuration, which is rare outside embedded Linux devices (Raspberry Pi acting as USB gadget, Android USB tethering stacks, industrial controllers). A key data conflict: the 'Information Disclosure' tag applied by Red Hat and SUSE is inconsistent with the C:N CVSS metric - security teams should verify whether an information disclosure path exists beyond sysfs path leakage before concluding no confidentiality impact applies. Overall, this is a real but low-priority kernel maintenance fix relevant primarily to embedded and mobile device vendors rather than server or cloud operators.

A local attacker with low-privilege access on an embedded Linux device - such as a single-board computer configured as a USB RNDIS gadget - repeatedly triggers USB gadget unbind events (by disconnecting and reconnecting the USB cable or administratively reconfiguring the gadget). Each unbind/rebind cycle creates or compounds dangling sysfs symlinks under /sys/class/net/, potentially causing userspace network management daemons (udev, NetworkManager) to encounter errors when enumerating network interfaces, resulting in a denial-of-service condition for USB network connectivity. No public proof-of-concept code has been identified at time of analysis.