In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_subset: Fix net_device lifecycle with device_move The net_device is allocated during function instance creation and registered during the bind phase with the gadget device as its sysfs parent. When the function unbinds, the parent device is destroyed, but the net_device survives, resulting in dangling sysfs symlinks: console:/ # ls -l /sys/class/net/usb0 lrwxrwxrwx ... /sys/class/net/usb0 -> /sys/devices/platform/.../gadget.0/net/usb0 console:/ # ls -l /sys/devices/platform/.../gadget.0/net/usb0 ls: .../gadget.0/net/usb0: No such file or directory Use device_move() to reparent the net_device between the gadget device tree and /sys/devices/virtual across bind and unbind cycles. During the final unbind, calling device_move(NULL) moves the net_device to the virtual device tree before the gadget device is destroyed. On rebinding, device_move() reparents the device back under the new gadget, ensuring proper sysfs topology and power management ordering. To maintain compatibility with legacy composite drivers (e.g., multi.c), the bound flag is used to indicate whether the network device is shared and pre-registered during the legacy driver's bind phase.

An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - usb: gadget: f_subset: Fix net_device lifecycle with device_move The net_device is allocated during     function instance creation and registered during the bind phase with the gadget device as its sysfs     parent. When the function unbinds, the parent device is destroyed, but the net_device survives, resulting     in dangling sysfs symlinks: console:/ # ls -l /sys/class/net/usb0 lrwxrwxrwx ... /sys/class/net/usb0 ->     /sys/devices/platform/.../gadget.0/net/usb0 console:/ # ls -l /sys/devices/platform/.../gadget.0/net/usb0     ls: .../gadget.0/net/usb0: No such file or directory Use device_move() to reparent the net_device between     the gadget device tree and /sys/devices/virtual across bind and unbind cycles. During the final unbind,     calling device_move(NULL) moves the net_device to the virtual device tree before the gadget device is     destroyed. On rebinding, device_move() reparents the device back under the new gadget, ensuring proper     sysfs topology and power management ordering. To maintain compatibility with legacy composite drivers     (e.g., multi.c), the bound flag is used to indicate whether the network device is shared and pre-     registered during the legacy driver's bind phase. (CVE-2026-31723)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
340680	Ubuntu 24.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (Raspberry Pi) vulnerabilities (USN-8665-1)	Nessus	Ubuntu Local Security Checks	Local	high
333798	Photon OS 5.0: Linux PHSA-2026-5.0-92-0849	Nessus	PhotonOS Local Security Checks	Local	high
318365	Photon OS 5.0: Linux PHSA-2026-5.0-0849	Nessus	PhotonOS Local Security Checks	Local	high
311588	Linux Distros Unpatched Vulnerability : CVE-2026-31723	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-31723

medium

Tenable Plugins

high

high

high

medium