CVE-2026-31726

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: uvc: fix NULL pointer dereference during unbind race

Commit b81ac4395bbe ("usb: gadget: uvc: allow for application to cleanly

shutdown") introduced two stages of synchronization waits totaling 1500ms

in uvc_function_unbind() to prevent several types of kernel panics.

However, this timing-based approach is insufficient during power

management (PM) transitions.

When the PM subsystem starts freezing user space processes, the

wait_event_interruptible_timeout() is aborted early, which allows the

unbind thread to proceed and nullify the gadget pointer

(cdev->gadget = NULL):

[ 814.123447][ T947] configfs-gadget.g1 gadget.0: uvc: uvc_function_unbind()

[ 814.178583][ T3173] PM: suspend entry (deep)

[ 814.192487][ T3173] Freezing user space processes

[ 814.197668][ T947] configfs-gadget.g1 gadget.0: uvc: uvc_function_unbind no clean disconnect, wait for release

When the PM subsystem resumes or aborts the

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References