# CVE-2026-31606

> Vulnerability · severity: **MEDIUM** (CVSS 5.5).

## Description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_hid: don't call cdev_init while cdev in use

When calling unbind, then bind again, cdev_init reinitialized the cdev,
even though there may still be references to it. That's the case when
the /dev/hidg* device is still opened. This obviously unsafe behavior
like oopes.

This fixes this by using cdev_alloc to put the cdev on the heap. That
way, we can simply allocate a new one in hidg_bind.

## Key facts

- **CVE ID:** CVE-2026-31606
- **Published:** 2026-04-24
- **CVSS severity:** MEDIUM
- **CVSS base score:** 5.5
- **CWE codes:** NVD-CWE-noinfo

## Affected products

- `linux:linux_kernel`

## Primary sources

- NIST NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-31606

## Citation

> AI Analytics. CVE-2026-31606. Retrieved 2026-07-23 from https://api.ai-analytics.org/cve/CVE-2026-31606. Derived from NIST NVD. Licensed CC0.

---

*[Dataset catalog](https://api.ai-analytics.org/datasets/) · [AI Analytics](https://api.ai-analytics.org/) · CC0 1.0*