CVE-2026-31606

usb: gadget: f_hid: don't call cdev_init while cdev in use

CVE-2026-31606 is fixed in 14 products on 1 platform, first by DEBIAN-CVE-2026-31606, released May 15, 2026. It is not reported as exploited. Patch Radar priority: Routine.

Routine
CVSS
5.5
Moderate
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0016
4th percentile

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_hid: don't call cdev_init while cdev in use When calling unbind, then bind again, cdev_init reinitialized the cdev, even though there may still be references to it. That's the case when the /dev/hidg* device is still opened. This obviously unsafe behavior like oopes. This fixes this by using cdev_alloc to put the cdev on the heap. That way, we can simply allocate a new one in hidg_bind.

Where it's fixed

ProductFixed inFixReleased
Linux
dtb-aarch64 · opensuse-leap 16.0 6.12.0-160000.37.1 OPENSUSE-SU-2026:21555-1 Aug 12, 2026
kernel-64kb · opensuse-leap 16.0 6.12.0-160000.37.1 OPENSUSE-SU-2026:21555-1 Aug 12, 2026
kernel-64kb · sles 16.0 6.12.0-160000.37.1 SUSE-SU-2026:23231-1 Aug 11, 2026
kernel-azure · opensuse-leap 16.0 6.12.0-160000.37.1 OPENSUSE-SU-2026:21555-1 Aug 12, 2026
kernel-azure · sles 16.0 6.12.0-160000.37.1 SUSE-SU-2026:23231-1 Aug 11, 2026
kernel-default · opensuse-leap 16.0 6.12.0-160000.37.1 OPENSUSE-SU-2026:21555-1 Aug 12, 2026
kernel-default · sles 16.0 6.12.0-160000.37.1 SUSE-SU-2026:23237-1 Aug 11, 2026
kernel-default-base · opensuse-leap 16.0 6.12.0-160000.37.1.160000.2.19 OPENSUSE-SU-2026:21555-1 Aug 12, 2026
kernel-default-base · sles 16.0 6.12.0-160000.37.1.160000.2.19 SUSE-SU-2026:23231-1 Aug 11, 2026
kernel-docs · opensuse-leap 16.0 6.12.0-160000.37.1 OPENSUSE-SU-2026:21555-1 Aug 12, 2026
kernel-docs · sles 16.0 6.12.0-160000.37.1 SUSE-SU-2026:23231-1 Aug 11, 2026
kernel-kvmsmall · opensuse-leap 16.0 6.12.0-160000.37.1 OPENSUSE-SU-2026:21555-1 Aug 12, 2026
kernel-kvmsmall · sles 16.0 6.12.0-160000.37.1 SUSE-SU-2026:23231-1 Aug 11, 2026
kernel-obs-build · opensuse-leap 16.0 6.12.0-160000.37.1 OPENSUSE-SU-2026:21555-1 Aug 12, 2026
kernel-obs-qa · opensuse-leap 16.0 6.12.0-160000.37.1 OPENSUSE-SU-2026:21555-1 Aug 12, 2026
kernel-obs-qa · sles 16.0 6.12.0-160000.37.1 SUSE-SU-2026:23231-1 Aug 11, 2026
kernel-rt · opensuse-leap 16.0 6.12.0-160000.37.1 OPENSUSE-SU-2026:21555-1 Aug 12, 2026
kernel-source · opensuse-leap 16.0 6.12.0-160000.37.1 OPENSUSE-SU-2026:21555-1 Aug 12, 2026
kernel-source · sles 16.0 6.12.0-160000.37.1 SUSE-SU-2026:23231-1 Aug 11, 2026
kernel-syms · opensuse-leap 16.0 6.12.0-160000.37.1 OPENSUSE-SU-2026:21555-1 Aug 12, 2026
kernel-syms · sles 16.0 6.12.0-160000.37.1 SUSE-SU-2026:23231-1 Aug 11, 2026
kernel-zfcpdump · opensuse-leap 16.0 6.12.0-160000.37.1 OPENSUSE-SU-2026:21555-1 Aug 12, 2026
kernel-zfcpdump · sles 16.0 6.12.0-160000.37.1 SUSE-SU-2026:23231-1 Aug 11, 2026
linux · Debian 13.5 (trixie) 6.12.85-1 DEBIAN-CVE-2026-31606 May 15, 2026
linux · Debian 14 6.19.14-1 DEBIAN-CVE-2026-31606 May 15, 2026

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.