CVE-2026-31606: usb: gadget: f_hid: don't call cdev_init while cdev in use

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-24 · updated 2026-10-30

Description

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_hid: don't call cdev_init while cdev in use When calling unbind, then bind again, cdev_init reinitialized the cdev, even though there may still be references to it. That's the case when the /dev/hidg* device is still opened. This obviously unsafe behavior like oopes. This fixes this by using cdev_alloc to put the cdev on the heap. That way, we can simply allocate a new one in hidg_bind.

Affected products

Linux kernel: from 3.19 before 6.12.83; from 6.13 before 6.18.24; from 6.19 before 6.19.14; from 7.0 before 7.0.1 — fixed in 6.12.83, 6.18.24, 6.19.14, 7.0.1
Linux: 3.19 — fixed in 7.1

How to fix

Upgrade to a fixed version: Linux kernel 6.12.83, 6.18.24, 6.19.14, 7.0.1; Linux 7.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-31606 or the next vulnerability affects your stack