0.0
NA
CVE-2026-31721
usb: gadget: f_hid: move list and spinlock inits from bind to alloc
Description

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_hid: move list and spinlock inits from bind to alloc There was an issue when you did the following: - setup and bind an hid gadget - open /dev/hidg0 - use the resulting fd in EPOLL_CTL_ADD - unbind the UDC - bind the UDC - use the fd in EPOLL_CTL_DEL When CONFIG_DEBUG_LIST was enabled, a list_del corruption was reported within remove_wait_queue (via ep_remove_wait_queue). After some debugging I found out that the queues, which f_hid registers via poll_wait were the problem. These were initialized using init_waitqueue_head inside hidg_bind. So effectively, the bind function re-initialized the queues while there were still items in them. The solution is to move the initialization from hidg_bind to hidg_alloc to extend their lifetimes to the lifetime of the function instance. Additionally, I found many other possibly problematic init calls in the bind function, which I moved as well.

INFO

Published Date :

May 1, 2026, 3:16 p.m.

Last Modified :

May 1, 2026, 3:24 p.m.

Remotely Exploit :

No

Source :

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products

The following products are affected by CVE-2026-31721 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

No affected product recoded yet

Solution
Reinitialize wait queues in alloc instead of bind to prevent list corruption.
  • Move wait queue initialization to hidg_alloc.
  • Ensure wait queues are properly initialized.
  • Review other init calls in bind function.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-31721 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-31721 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-31721 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2026-31721 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    May. 01, 2026

    Action Type Old Value New Value
    Added Description In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_hid: move list and spinlock inits from bind to alloc There was an issue when you did the following: - setup and bind an hid gadget - open /dev/hidg0 - use the resulting fd in EPOLL_CTL_ADD - unbind the UDC - bind the UDC - use the fd in EPOLL_CTL_DEL When CONFIG_DEBUG_LIST was enabled, a list_del corruption was reported within remove_wait_queue (via ep_remove_wait_queue). After some debugging I found out that the queues, which f_hid registers via poll_wait were the problem. These were initialized using init_waitqueue_head inside hidg_bind. So effectively, the bind function re-initialized the queues while there were still items in them. The solution is to move the initialization from hidg_bind to hidg_alloc to extend their lifetimes to the lifetime of the function instance. Additionally, I found many other possibly problematic init calls in the bind function, which I moved as well.
    Added Reference https://git.kernel.org/stable/c/13440c0db227c5db01da751ed966dde4cdd2ea18
    Added Reference https://git.kernel.org/stable/c/26a879a41ed960b3fb4ec773ef2788c515c0e488
    Added Reference https://git.kernel.org/stable/c/4e0a88254ad59f6c53a34bf5fa241884ec09e8b2
    Added Reference https://git.kernel.org/stable/c/5d1bb391ceeebb28327703dd07af8c6324af298f
    Added Reference https://git.kernel.org/stable/c/81aee4500055876883658b024b6fb61801afe134
    Added Reference https://git.kernel.org/stable/c/8ec6a58586f195a88479edcdb0b8027c39f12d03
    Added Reference https://git.kernel.org/stable/c/de93e0862169b5539e00c2b9980b93fd80c37c0d
    Added Reference https://git.kernel.org/stable/c/f7d00ee1c8082c8a134340aaf16d71a27e29c362
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.