Linux Kernel EUVD-2026-26537

Exploitation requires: (1) USB gadget mode enabled in kernel (CONFIG_USB_GADGET_EEM must be compiled in), (2) EEM gadget function actively configured and registered on the target system, (3) Local shell access with privileges sufficient to manipulate /sys/bus/platform/devices or /sys/bus/usb device binding (typically UID 0 / root, or unprivileged users with CAP_SYS_ADMIN capability), (4) Ability to trigger gadget unbind and rebind cycles via sysfs interface or USB hotplug emulation. Standard server/desktop distributions do NOT expose gadget functionality by default; this vulnerability primarily affects embedded systems, mobile devices, IoT platforms, and development machines where USB peripheral emulation is explicitly configured. Non-gadget kernel configurations are unaffected regardless of CVSS vector. Presence of /sys/bus/platform/devices/ gadget entries and dmesg showing 'g_eem' module or gadget initialization indicates vulnerable configuration.

CVSS 5.5 indicates moderate severity with local attack vector (AV:L) and low complexity (AC:L), requiring low privileges (PR:L) and no user interaction (UI:N), with availability impact only (A:H). However, EPSS exploitation probability is extremely low at 0.02% percentile (5th percentile), suggesting this is a theoretical vulnerability with minimal real-world threat despite confirmed patch availability. The vulnerability is NOT listed in CISA KEV, indicating no confirmed active exploitation. Attack surface is limited to systems running affected Linux kernel versions WITH USB gadget mode enabled and configured-not enabled by default on most distributions. The local privilege requirement (PR:L) further restricts realistic attack scenarios to already-compromised accounts or local system administrators. Risk assessment: HIGH theoretical severity but LOW practical risk due to restrictive prerequisites, no active exploitation evidence, minimal EPSS score, and requirement for local privileged access. Organizations should prioritize patch deployment only if running USB gadget configurations; standard server/desktop deployments face negligible risk.

An attacker with local login access to a Linux system configured with USB gadget EEM mode (e.g., embedded device, mobile phone running custom kernel, development board) triggers repeated unbind/rebind cycles of the EEM gadget device via sysfs control or USB hotplug simulation. Each unbind operation leaves dangling sysfs symlinks that corrupt the device reference tree, eventually causing kernel panic or denial of service when network stack attempts to access invalid device pointers. POC would involve shell commands like 'echo 0 > /sys/bus/platform/devices/[gadget]/bind' followed by rebind operations to trigger the condition.