VulnerabilityPublished 24 Apr 2026Updated 21 Oct 2026

CVE-2026-31606: Linux kernel · usb: gadget: f_hid: don't call cdev_init while cdev in use

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in eb6ef6185f2054a341ec70d7e2165f5381744215 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 14:18 UTC

Severity

Unrated

Rated by Threat Radar · No CVSS score from NVD or the CNA

EPSS: 0.1% chance of exploitation in 30 days – higher than 4% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in eb6ef6185f2054a341ec70d7e2165f5381744215, c6c0d13db5d0f8d465eabc14bd23d2b6a7247a43, 81ebd43cc0d6d106ce7b6ccbf7b5e40ca7f5503d +3

Exploitation evidence

Disclosed: evidence found.
CVE published 24 Apr 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ cb382536052fcc7713988869b54a81137069e5a9, < eb6ef6185f2054a341ec70d7e2165f5381744215	Fixed in eb6ef6185f2054a341ec70d7e2165f5381744215
LinuxLinux	Affected ≥ cb382536052fcc7713988869b54a81137069e5a9, < c6c0d13db5d0f8d465eabc14bd23d2b6a7247a43	Fixed in c6c0d13db5d0f8d465eabc14bd23d2b6a7247a43
LinuxLinux	Affected ≥ cb382536052fcc7713988869b54a81137069e5a9, < 81ebd43cc0d6d106ce7b6ccbf7b5e40ca7f5503d	Fixed in 81ebd43cc0d6d106ce7b6ccbf7b5e40ca7f5503d
LinuxLinux	Affected ≥ cb382536052fcc7713988869b54a81137069e5a9, < 75ecc46828ec377dd5692c677168ef6d64fd7123	Fixed in 75ecc46828ec377dd5692c677168ef6d64fd7123
LinuxLinux	Affected ≥ cb382536052fcc7713988869b54a81137069e5a9, < 5a229016ca3ac551294ec59770be9da94ec4bf63	Fixed in 5a229016ca3ac551294ec59770be9da94ec4bf63
LinuxLinux	Affected ≥ cb382536052fcc7713988869b54a81137069e5a9, < 3aa77f5da0ecb00895411f4246d8a3e4db0343c2	Fixed in 3aa77f5da0ecb00895411f4246d8a3e4db0343c2

Description

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_hid: don't call cdev_init while cdev in use When calling unbind, then bind again, cdev_init reinitialized the cdev, even though there may still be references to it. That's the case when the /dev/hidg* device is still opened. This obviously unsafe behavior like oopes. This fixes this by using cdev_alloc to put the cdev on the heap. That way, we can simply allocate a new one in hidg_bind.

References

Community reviews

Loading reviews…