CVE-2026-31725

{"id": "CVE-2026-31725", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "fee562a6450b7806f1fbbe1469a67b5395b5c10a", "lessThan": "40c4d35c71a170889fe9333a1feb69a4dd5d4365", "versionType": "git"}, {"status": "affected", "version": "fee562a6450b7806f1fbbe1469a67b5395b5c10a", "lessThan": "fdc3aa4c23d3e0ed781ca0e10213c645e445cc03", "versionType": "git"}, {"status": "affected", "version": "fee562a6450b7806f1fbbe1469a67b5395b5c10a", "lessThan": "5eaeac22240d965d24c3bd0c54ded64efd8f6ca1", "versionType": "git"}, {"status": "affected", "version": "fee562a6450b7806f1fbbe1469a67b5395b5c10a", "lessThan": "4e34f3f491fd731809b57ddb5329ec763bd39553", "versionType": "git"}, {"status": "affected", "version": "fee562a6450b7806f1fbbe1469a67b5395b5c10a", "lessThan": "9b1e5589593293c78a2ab8bb118a41e2271a2af8", "versionType": "git"}, {"status": "affected", "version": "fee562a6450b7806f1fbbe1469a67b5395b5c10a", "lessThan": "b2cc4fae67a51f60d81d6af2678696accb07c656", "versionType": "git"}], "programFiles": ["drivers/usb/gadget/function/f_ecm.c", "drivers/usb/gadget/function/u_ecm.h"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.11"}, {"status": "unaffected", "version": "0", "lessThan": "3.11", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.191", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.160", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.81", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.22", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.12", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/usb/gadget/function/f_ecm.c", "drivers/usb/gadget/function/u_ecm.h"], "defaultStatus": "affected"}]}], "published": "2026-05-01T15:16:34.947", "references": [{"url": "https://git.kernel.org/stable/c/40c4d35c71a170889fe9333a1feb69a4dd5d4365", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/4e34f3f491fd731809b57ddb5329ec763bd39553", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/5eaeac22240d965d24c3bd0c54ded64efd8f6ca1", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/9b1e5589593293c78a2ab8bb118a41e2271a2af8", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/b2cc4fae67a51f60d81d6af2678696accb07c656", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/fdc3aa4c23d3e0ed781ca0e10213c645e445cc03", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_ecm: Fix net_device lifecycle with device_move\n\nThe net_device is allocated during function instance creation and\nregistered during the bind phase with the gadget device as its sysfs\nparent. When the function unbinds, the parent device is destroyed, but\nthe net_device survives, resulting in dangling sysfs symlinks:\n\n console:/ # ls -l /sys/class/net/usb0\n lrwxrwxrwx ... /sys/class/net/usb0 ->\n /sys/devices/platform/.../gadget.0/net/usb0\n console:/ # ls -l /sys/devices/platform/.../gadget.0/net/usb0\n ls: .../gadget.0/net/usb0: No such file or directory\n\nUse device_move() to reparent the net_device between the gadget device\ntree and /sys/devices/virtual across bind and unbind cycles. During the\nfinal unbind, calling device_move(NULL) moves the net_device to the\nvirtual device tree before the gadget device is destroyed. On rebinding,\ndevice_move() reparents the device back under the new gadget, ensuring\nproper sysfs topology and power management ordering.\n\nTo maintain compatibility with legacy composite drivers (e.g., multi.c),\nthe bound flag is used to indicate whether the network device is shared\nand pre-registered during the legacy driver's bind phase."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nusb: gadget: f_ecm: Correcci\u00f3n del ciclo de vida de net_device con device_move\n\nEl net_device se asigna durante la creaci\u00f3n de la instancia de funci\u00f3n y se registra durante la fase de enlace con el dispositivo gadget como su padre sysfs. Cuando la funci\u00f3n se desvincula, el dispositivo padre es destruido, pero el net_device sobrevive, lo que resulta en enlaces simb\u00f3licos sysfs colgantes:\n\n console:/ # ls -l /sys/class/net/usb0\n lrwxrwxrwx ... /sys/class/net/usb0 -> \n /sys/devices/platform/... / gadget.0/net/usb0\n console:/ # ls -l /sys/devices/platform/... / gadget.0/net/usb0\n ls: ... / gadget.0/net/usb0: No existe tal archivo o directorio\n\nUsar device_move() para reasignar el padre al net_device entre el \u00e1rbol de dispositivos gadget y /sys/devices/virtual a trav\u00e9s de los ciclos de enlace y desvinculaci\u00f3n. Durante la desvinculaci\u00f3n final, al llamar a device_move(NULL) se mueve el net_device al \u00e1rbol de dispositivos virtual antes de que el dispositivo gadget sea destruido. Al volver a enlazar, device_move() reasigna el padre al dispositivo de nuevo bajo el nuevo gadget, asegurando una topolog\u00eda sysfs y un orden de gesti\u00f3n de energ\u00eda adecuados.\n\nPara mantener la compatibilidad con controladores compuestos heredados (p. ej., multi.c), se utiliza la bandera \u2019bound\u2019 para indicar si el dispositivo de red se comparte y se pre-registra durante la fase de enlace del controlador heredado."}], "lastModified": "2026-11-11T21:10:00.200", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2DDEB484-A8B8-4ED2-B54C-C92F595BA13F", "versionEndExcluding": "6.12.81", "versionStartIncluding": "3.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C9DF8BCE-36D3-475D-9D21-19E4F02F9029", "versionEndExcluding": "6.18.22", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0A2B9540-02D5-41B4-B16A-82AF66FD4F36", "versionEndExcluding": "6.19.12", "versionStartIncluding": "6.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}