Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-31721— usb: gadget: f_hid: move list and spinlock inits from bind to alloc

AI Predicted 5.5 Difficulty: Moderate EPSS 0.12% · P2

Possible ATT&CK Techniques 1AI

T1211 · Exploitation for Stealth

Affected Version Matrix 18

VendorProductVersion RangeStatus
LinuxLinuxcb382536052fcc7713988869b54a81137069e5a9< 13440c0db227c5db01da751ed966dde4cdd2ea18affected
cb382536052fcc7713988869b54a81137069e5a9< de93e0862169b5539e00c2b9980b93fd80c37c0daffected
cb382536052fcc7713988869b54a81137069e5a9< 81aee4500055876883658b024b6fb61801afe134affected
cb382536052fcc7713988869b54a81137069e5a9< 8ec6a58586f195a88479edcdb0b8027c39f12d03affected
cb382536052fcc7713988869b54a81137069e5a9< f7d00ee1c8082c8a134340aaf16d71a27e29c362affected
cb382536052fcc7713988869b54a81137069e5a9< 5d1bb391ceeebb28327703dd07af8c6324af298faffected
cb382536052fcc7713988869b54a81137069e5a9< 26a879a41ed960b3fb4ec773ef2788c515c0e488affected
cb382536052fcc7713988869b54a81137069e5a9< 4e0a88254ad59f6c53a34bf5fa241884ec09e8b2affected
… +10 more rows
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-31721

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
usb: gadget: f_hid: move list and spinlock inits from bind to alloc
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_hid: move list and spinlock inits from bind to alloc There was an issue when you did the following: - setup and bind an hid gadget - open /dev/hidg0 - use the resulting fd in EPOLL_CTL_ADD - unbind the UDC - bind the UDC - use the fd in EPOLL_CTL_DEL When CONFIG_DEBUG_LIST was enabled, a list_del corruption was reported within remove_wait_queue (via ep_remove_wait_queue). After some debugging I found out that the queues, which f_hid registers via poll_wait were the problem. These were initialized using init_waitqueue_head inside hidg_bind. So effectively, the bind function re-initialized the queues while there were still items in them. The solution is to move the initialization from hidg_bind to hidg_alloc to extend their lifetimes to the lifetime of the function instance. Additionally, I found many other possibly problematic init calls in the bind function, which I moved as well.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于f_hid中列表和自旋锁初始化时机不当，可能导致列表损坏。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
LinuxLinux cb382536052fcc7713988869b54a81137069e5a9 ~ 13440c0db227c5db01da751ed966dde4cdd2ea18 -
LinuxLinux 3.19 -

II. Public POCs for CVE-2026-31721

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-31721

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-31721 (8)

Same Patch Batch · Linux · 2026-05-01 · 146 CVEs total

CVE-2026-430119.8 CRITICALnet/x25: Fix potential double free of skb
CVE-2026-430379.8 CRITICALip6_tunnel: clear skb2->cb[] in ip4ip6_err()
CVE-2026-317059.8 CRITICALksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment
CVE-2026-430389.8 CRITICALipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()
CVE-2026-430399.8 CRITICALnet: ti: icssg-prueth: fix missing data copy and wrong recycle in ZC RX dispatch
CVE-2026-317189.8 CRITICALksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger
CVE-2026-430188.8 HIGHBluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt
CVE-2026-317738.8 HIGHBluetooth: SMP: derive legacy responder STK authentication from MITM state
CVE-2026-317398.8 HIGHcrypto: tegra - Add missing CRYPTO_ALG_ASYNC
CVE-2026-317358.8 HIGHiommupt: Fix short gather if the unmap goes into a large mapping
CVE-2026-317178.8 HIGHksmbd: validate owner of durable handle on reconnect
CVE-2026-430488.8 HIGHHID: core: Mitigate potential OOB by removing bogus memset()
CVE-2026-317098.8 HIGHsmb: client: validate the whole DACL before rewriting it in cifsacl
CVE-2026-317068.8 HIGHksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl()
CVE-2026-317128.3 HIGHksmbd: require minimum ACE size in smb_check_perm_dacl()
CVE-2026-317718.1 HIGHBluetooth: hci_event: move wake reason storage into validated event handlers
CVE-2026-317798.1 HIGHwifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler()
CVE-2026-430518.1 HIGHHID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq
CVE-2026-317088.1 HIGHsmb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path
CVE-2026-316957.8 HIGHwifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free

Showing top 20 of 146 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-31721

No comments yet

Leave a comment