Medium 5.5Published May 1, 2026

CVE-2026-31721usb: gadget: f_hid: move list and spinlock inits from bind to alloc

Updated under an hour ago (Oct 28, 2026, 5:00 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_hid: move list and spinlock inits from bind to alloc There was an issue when you did the following: - setup and bind an hid gadget - open /dev/hidg0 - use the resulting fd in EPOLL_CTL_ADD - unbind the UDC - bind the UDC - use the fd in EPOLL_CTL_DEL When CONFIG_DEBUG_LIST was enabled, a list_del corruption was reported within remove_wait_queue (via ep_remove_wait_queue). After some debugging I found out that the queues, which f_hid registers via poll_wait were the problem. These were initialized using init_waitqueue_head inside hidg_bind. So effectively, the bind function re-initialized the queues while there were still items in them. The solution is to move the initialization from hidg_bind to hidg_alloc to extend their lifetimes to the lifetime of the function instance. Additionally, I found many other possibly problematic init calls in the bind function, which I moved as well.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from cb382536052fcc7713988869b54a81137069e5a9 before 13440c0db227c5db01da751ed966dde4cdd2ea18; from cb382536052fcc7713988869b54a81137069e5a9 before de93e0862169b5539e00c2b9980b93fd80c37c0d; from cb382536052fcc7713988869b54a81137069e5a9 before 81aee4500055876883658b024b6fb61801afe134; from cb382536052fcc7713988869b54a81137069e5a9 before 8ec6a58586f195a88479edcdb0b8027c39f12d03; from cb382536052fcc7713988869b54a81137069e5a9 before f7d00ee1c8082c8a134340aaf16d71a27e29c362; from cb382536052fcc7713988869b54a81137069e5a9 before 5d1bb391ceeebb28327703dd07af8c6324af298f; from cb382536052fcc7713988869b54a81137069e5a9 before 26a879a41ed960b3fb4ec773ef2788c515c0e488; from cb382536052fcc7713988869b54a81137069e5a9 before 4e0a88254ad59f6c53a34bf5fa241884ec09e8b2	CNA record
linux linux_kernel linux:linux_kernel	from 3.19 before 5.10.253; from 5.11 before 5.15.203; from 5.16 before 6.1.169; from 6.2 before 6.6.135; from 6.7 before 6.12.81; from 6.13 before 6.18.22; from 6.19 before 6.19.12; 7.0; and 5 more ranges	NVD

References

References

https://git.kernel.org/stable/c/13440c0db227c5db01da751ed966dde4cdd2ea18	patch
https://git.kernel.org/stable/c/de93e0862169b5539e00c2b9980b93fd80c37c0d	patch
https://git.kernel.org/stable/c/81aee4500055876883658b024b6fb61801afe134	patch
https://git.kernel.org/stable/c/8ec6a58586f195a88479edcdb0b8027c39f12d03	patch
https://git.kernel.org/stable/c/f7d00ee1c8082c8a134340aaf16d71a27e29c362	patch
https://git.kernel.org/stable/c/5d1bb391ceeebb28327703dd07af8c6324af298f	patch
https://git.kernel.org/stable/c/26a879a41ed960b3fb4ec773ef2788c515c0e488	patch
https://git.kernel.org/stable/c/4e0a88254ad59f6c53a34bf5fa241884ec09e8b2	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.