---
id: CVE-2026-31725
title: 'usb: gadget: f_ecm: Fix net_device lifecycle with device_move'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  usb: gadget: f_ecm: Fix net_device lifecycle with device_move

  The net_device is allocated during function instance creation and
  registered during the bind phase with t…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= fee562a6450b7806f1fbbe1469a67b5395b5c10a <
    fdc3aa4c23d3e0ed781ca0e10213c645e445cc03
  - >-
    Linux >= fee562a6450b7806f1fbbe1469a67b5395b5c10a <
    5eaeac22240d965d24c3bd0c54ded64efd8f6ca1
  - >-
    Linux >= fee562a6450b7806f1fbbe1469a67b5395b5c10a <
    4e34f3f491fd731809b57ddb5329ec763bd39553
  - >-
    Linux >= fee562a6450b7806f1fbbe1469a67b5395b5c10a <
    9b1e5589593293c78a2ab8bb118a41e2271a2af8
  - >-
    Linux >= fee562a6450b7806f1fbbe1469a67b5395b5c10a <
    b2cc4fae67a51f60d81d6af2678696accb07c656
  - Linux 3.11
published: '2026-05-01'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T12:39:46.383Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-31725'
references:
  - url: 'https://git.kernel.org/stable/c/fdc3aa4c23d3e0ed781ca0e10213c645e445cc03'
  - url: 'https://git.kernel.org/stable/c/5eaeac22240d965d24c3bd0c54ded64efd8f6ca1'
  - url: 'https://git.kernel.org/stable/c/4e34f3f491fd731809b57ddb5329ec763bd39553'
  - url: 'https://git.kernel.org/stable/c/9b1e5589593293c78a2ab8bb118a41e2271a2af8'
  - url: 'https://git.kernel.org/stable/c/b2cc4fae67a51f60d81d6af2678696accb07c656'
tags:
  - cve.org
epss: 0.00162
epssPercentile: 0.04992
ingestedAt: '2026-10-21T12:48:53.657Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_ecm: Fix net_device lifecycle with device_move

The net_device is allocated during function instance creation and
registered during the bind phase with the gadget device as its sysfs
parent. When the function unbinds, the parent device is destroyed, but
the net_device survives, resulting in dangling sysfs symlinks:

  console:/ # ls -l /sys/class/net/usb0
  lrwxrwxrwx ... /sys/class/net/usb0 ->
  /sys/devices/platform/.../gadget.0/net/usb0
  console:/ # ls -l /sys/devices/platform/.../gadget.0/net/usb0
  ls: .../gadget.0/net/usb0: No such file or directory

Use device_move() to reparent the net_device between the gadget device
tree and /sys/devices/virtual across bind and unbind cycles. During the
final unbind, calling device_move(NULL) moves the net_device to the
virtual device tree before the gadget device is destroyed. On rebinding,
device_move() reparents the device back under the new gadget, ensuring
proper sysfs topology and power management ordering.

To maintain compatibility with legacy composite drivers (e.g., multi.c),
the bound flag is used to indicate whether the network device is shared
and pre-registered during the legacy driver's bind phase.

## Affected

- `Linux >= fee562a6450b7806f1fbbe1469a67b5395b5c10a < fdc3aa4c23d3e0ed781ca0e10213c645e445cc03`
- `Linux >= fee562a6450b7806f1fbbe1469a67b5395b5c10a < 5eaeac22240d965d24c3bd0c54ded64efd8f6ca1`
- `Linux >= fee562a6450b7806f1fbbe1469a67b5395b5c10a < 4e34f3f491fd731809b57ddb5329ec763bd39553`
- `Linux >= fee562a6450b7806f1fbbe1469a67b5395b5c10a < 9b1e5589593293c78a2ab8bb118a41e2271a2af8`
- `Linux >= fee562a6450b7806f1fbbe1469a67b5395b5c10a < b2cc4fae67a51f60d81d6af2678696accb07c656`
- `Linux 3.11`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.