PT-2026-36356 · Linux · Linux Kernel

Published 2026-05-01 · Updated 2026-05-26 · CVE-2026-31721

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the USB gadget HID function where list and spinlock initializations were performed during the bind process. Specifically, queues registered via poll wait were initialized using init waitqueue head inside the hidg bind() function. This caused the bind function to re-initialize queues while they still contained items, leading to list del corruption within remove wait queue() (via ep remove wait queue) when CONFIG DEBUG LIST was enabled. This occurs during a sequence of setting up and binding an HID gadget, opening /dev/hidg0, using the file descriptor in EPOLL CTL ADD, unbinding and rebinding the UDC, and finally using the file descriptor in EPOLL CTL DEL.

Recommendations Move the initialization of lists and spinlocks from the hidg bind() function to the hidg alloc() function to ensure their lifetimes match the function instance.

Fix

Related Identifiers

CVE-2026-31721

ECHO-65EB-E483-5F6E

Affected Products

Linux Kernel

References · 19

• https://git.kernel.org/stable/c/13440c0db227c5db01da751ed966dde4cdd2ea18 · Patch
• https://git.kernel.org/stable/c/8ec6a58586f195a88479edcdb0b8027c39f12d03 · Patch
• https://git.kernel.org/stable/c/f7d00ee1c8082c8a134340aaf16d71a27e29c362 · Patch
• https://git.kernel.org/stable/c/5d1bb391ceeebb28327703dd07af8c6324af298f · Patch
• https://git.kernel.org/stable/c/26a879a41ed960b3fb4ec773ef2788c515c0e488 · Patch
• https://ubuntu.com/security/CVE-2026-31721 · Vendor Advisory
• https://git.kernel.org/stable/c/de93e0862169b5539e00c2b9980b93fd80c37c0d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-31721 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31721 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31721 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-31721 · Security Note
• https://osv.dev/vulnerability/BELL-CVE-2026-31721 · Vendor Advisory
• https://git.kernel.org/stable/c/81aee4500055876883658b024b6fb61801afe134 · Patch
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2026-31721 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-31721 · Vendor Advisory