Description
In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_hid: don't call cdev_init while cdev in use

When calling unbind, then bind again, cdev_init reinitialized the cdev,
even though there may still be references to it. That's the case when
the /dev/hidg* device is still opened. This obviously unsafe behavior
like oopes.

This fixes this by using cdev_alloc to put the cdev on the heap. That
way, we can simply allocate a new one in hidg_bind.
Published: 2026-04-24
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A bug in the Linux kernel’s USB gadget HID driver causes the character device (cdev) to be reinitialized while it is still in use. The buggy code invokes cdev_init again on an existing cdev that may still have open references, leading to memory corruption and an 'oops' kernel crash. This vulnerability can result in denial-of-service by crashing the system. The weakness is a classic Resource Management error (CWE-413).

Affected Systems

All Linux kernel builds that include the f_hid gadget driver without the patch. The affected code is part of the usb: gadget subsystem; specific kernel versions are not enumerated in the provided data, so any kernel that has shipped the unpatched f_hid module may be vulnerable.

Risk and Exploitability

The EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 5.5 reflects medium severity. Exploitation would likely require local access to a system that hosts a USB gadget using the f_hid driver and would exploit the reinitialization bug to corrupt kernel memory, potentially crashing the system. The attack vector is local, based on manipulating the bind/unbind sequence of the HID gadget device.

Generated by OpenCVE AI on April 30, 2026 at 04:07 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Check the installed kernel version and compare it against known patched releases that move from cdev_init to cdev_alloc in hidg_bind.
  • If an affected kernel is in use, apply the patch that allocates the cdev on the heap, preventing reuse of an active device.
  • Verify that the USB gadget HID driver is disabled or updated on systems that do not require HID functionality to reduce exposure.

Generated by OpenCVE AI on April 30, 2026 at 04:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6238-1 linux security update
History

Wed, 29 Apr 2026 20:15:00 +0000

Type Values Removed Values Added
Weaknesses NVD-CWE-noinfo
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

Mon, 27 Apr 2026 11:30:00 +0000

Type Values Removed Values Added
References

Sat, 25 Apr 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-413
References

Fri, 24 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_hid: don't call cdev_init while cdev in use When calling unbind, then bind again, cdev_init reinitialized the cdev, even though there may still be references to it. That's the case when the /dev/hidg* device is still opened. This obviously unsafe behavior like oopes. This fixes this by using cdev_alloc to put the cdev on the heap. That way, we can simply allocate a new one in hidg_bind.
Title usb: gadget: f_hid: don't call cdev_init while cdev in use
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-05-11T22:12:03.516Z

Reserved: 2026-03-09T15:48:24.122Z

Link: CVE-2026-31606

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2026-04-24T15:16:39.830

Modified: 2026-04-29T20:00:34.693

Link: CVE-2026-31606

cve-icon Redhat

Severity :

Publid Date: 2026-04-24T00:00:00Z

Links: CVE-2026-31606 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-30T04:15:26Z

Weaknesses