Security readout for executives and security teams
Plain-English summary
A flaw in the Linux USB Test and Measurement Class driver can leave USB operations running after related memory is released. A later USB completion may access that freed memory, potentially crashing or compromising the system. The supplied CVSS score is 7.8, reflecting high potential impact but requiring local, low-privileged access.
Executive priority
Treat this as a high-priority kernel maintenance issue on endpoints or specialized systems using usbtmc. It is not presented as remotely exploitable or actively exploited, so prioritize confirmed driver exposure and privileged multi-user environments rather than initiating an indiscriminate emergency response.
Technical view
During usbtmc_release, pending anchored USB Request Blocks were not flushed before associated state could be freed. A subsequent host-controller giveback could therefore trigger a use-after-free. The Linux stable fixes call usbtmc_draw_down() during release so anchored requests can complete safely.
Likely exposure
Exposure is most plausible on systems running an affected Linux kernel where the usbtmc driver is present and used. The supplied affected-version data is irregular and does not establish dependable version ranges, so distribution package status or inclusion of the cited stable commits should determine exposure.
Exploitation context
The CVSS vector describes local, low-complexity exploitation requiring low privileges and no user interaction, with potentially high confidentiality, integrity, and availability impact. The bundle marks this CVE as absent from KEV and provides no evidence of active exploitation or a public exploit.
Researcher notes
The described fault is a release-time race involving anchored URBs and later HCD completion. The supplied records identify multiple stable-tree commits, but provide no reproducer, affected configuration details, exploitation evidence, or reliable branch boundaries. Validate fixes through distribution backport metadata because package versions may not align directly with upstream versions.
Mitigation direction
- Install a vendor-supported kernel update that includes the applicable Linux stable fix.
- Check Linux distribution security guidance for the exact fixed package version.
- Prioritize systems using USB Test and Measurement Class devices or the usbtmc driver.
- Reboot into the updated kernel following normal change-control procedures.
Validation and detection
- Record the running kernel and installed kernel package versions.
- Determine whether the usbtmc driver is present and used on each system.
- Verify the vendor package includes CVE-2026-31758 remediation or an applicable cited commit.
- After reboot, confirm the running kernel matches the remediated package.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-31758 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/959ef329071136e4335b54822fe2f607659b4569CVE reference, Linux
- https://git.kernel.org/stable/c/e189d443767f7cd390c52f2e122e1fc41c7562d6CVE reference, Linux
- https://git.kernel.org/stable/c/7fa8f61bab3fb75b5deba8a0f3abb74dc5068d9fCVE reference, Linux
- https://git.kernel.org/stable/c/95e09b07e50290254b28b8395509473104518f8cCVE reference, Linux
- https://git.kernel.org/stable/c/d13318dec0c1e0e2ac16f8ecbd522db14cea4bb1CVE reference, Linux
- https://git.kernel.org/stable/c/977b632db51d231dec0bc571089a5c2402674139CVE reference, Linux
- https://git.kernel.org/stable/c/d40198de50232e04c14c6e2092e896766c95ea48CVE reference, Linux
- https://git.kernel.org/stable/c/8a768552f7a8276fb9e01d49773d2094ace7c8f1CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.