In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_subset: Fix net_device lifecycle with device_move The net_device is allocated during function instance creation and registered during the bind phase with the gadget device as its sysfs parent. When the function unbinds, the parent device is destroyed, but the net_device survives, resulting in dangling sysfs symlinks: console:/ # ls -l /sys/class/net/usb0 lrwxrwxrwx ... /sys/class/net/usb0 -> /sys/devices/platform/.../gadget.0/net/usb0 console:/ # ls -l /sys/devices/platform/.../gadget.0/net/usb0 ls: .../gadget.0/net/usb0: No such file or directory Use device_move() to reparent the net_device between the gadget device tree and /sys/devices/virtual across bind and unbind cycles. During the final unbind, calling device_move(NULL) moves the net_device to the virtual device tree before the gadget device is destroyed. On rebinding, device_move() reparents the device back under the new gadget, ensuring proper sysfs topology and power management ordering. To maintain compatibility with legacy composite drivers (e.g., multi.c), the bound flag is used to indicate whether the network device is shared and pre-registered during the legacy driver's bind phase.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_subset: Fix net_device
    lifecycle with device_move The net_device is allocated during function instance creation and registered
    during the bind phase with the gadget device as its sysfs parent. When the function unbinds, the parent
    device is destroyed, but the net_device survives, resulting in dangling sysfs symlinks: console:/ # ls -l
    /sys/class/net/usb0 lrwxrwxrwx ... /sys/class/net/usb0 -> /sys/devices/platform/.../gadget.0/net/usb0
    console:/ # ls -l /sys/devices/platform/.../gadget.0/net/usb0 ls: .../gadget.0/net/usb0: No such file or
    directory Use device_move() to reparent the net_device between the gadget device tree and
    /sys/devices/virtual across bind and unbind cycles. During the final unbind, calling device_move(NULL)
    moves the net_device to the virtual device tree before the gadget device is destroyed. On rebinding,
    device_move() reparents the device back under the new gadget, ensuring proper sysfs topology and power
    management ordering. To maintain compatibility with legacy composite drivers (e.g., multi.c), the bound
    flag is used to indicate whether the network device is shared and pre-registered during the legacy
    driver's bind phase. (CVE-2026-31723)

An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - usb: gadget: f_subset: Fix net_device lifecycle with device_move The net_device is allocated during     function instance creation and registered during the bind phase with the gadget device as its sysfs     parent. When the function unbinds, the parent device is destroyed, but the net_device survives, resulting     in dangling sysfs symlinks: console:/ # ls -l /sys/class/net/usb0 lrwxrwxrwx ... /sys/class/net/usb0 ->     /sys/devices/platform/.../gadget.0/net/usb0 console:/ # ls -l /sys/devices/platform/.../gadget.0/net/usb0     ls: .../gadget.0/net/usb0: No such file or directory Use device_move() to reparent the net_device between     the gadget device tree and /sys/devices/virtual across bind and unbind cycles. During the final unbind,     calling device_move(NULL) moves the net_device to the virtual device tree before the gadget device is     destroyed. On rebinding, device_move() reparents the device back under the new gadget, ensuring proper     sysfs topology and power management ordering. To maintain compatibility with legacy composite drivers     (e.g., multi.c), the bound flag is used to indicate whether the network device is shared and pre-     registered during the legacy driver's bind phase. (CVE-2026-31723)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
461022	Echo: linux: security update to 6.12.85-1	Tenable Cloud Security	Echo Local Security Checks	Local	medium
461022	Echo: linux: security update to 6.12.85-1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
340680	Ubuntu 24.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (Raspberry Pi) vulnerabilities (USN-8665-1)	Nessus	Ubuntu Local Security Checks	Local	high
333798	Photon OS 5.0: Linux PHSA-2026-5.0-92-0849	Nessus	PhotonOS Local Security Checks	Local	high
318365	Photon OS 5.0: Linux PHSA-2026-5.0-0849	Nessus	PhotonOS Local Security Checks	Local	high
311588	Linux Distros Unpatched Vulnerability : CVE-2026-31723	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-31723

medium

Tenable Plugins

medium

medium

high

high

high

medium