The Linux kernel’s HID gadget driver contained an ordering problem in which wait‑queue heads and list structures were initialized during the bind phase while they still held queued items. When a user opened /dev/hidg0, registered the descriptor with EPOLL, caused the device controller to unbind and rebind, and then deleted the EPOLL entry, the driver re‑initialized these structures, corrupting kernel pointers. This kernel data‑structure corruption can trigger a list_del error and potentially allow a local user to execute code with elevated privileges.

All Linux kernel releases that include the f_hid gadget driver and use the bind‑time initialization sequence are affected. The patch that moves initialization to the allocation stage is present in later kernel versions; therefore, any kernel before the commit that introduced this change is vulnerable. Exact version numbers are not provided in the CVE description.

The vulnerability is local; an attacker must have permission to open /dev/hidg0 on the affected system. No publicly available exploit code is known and the EPSS score is not reported, so the risk must be assessed manually. The flaw is a high‑severity kernel data‑corruption bug that could lead to privilege escalation. It is not listed in CISA’s KEV catalogue, and the remaining exploitation window depends on the attacker’s ability to drive the exact bind/unbind/epoll sequence.