A submodule is by definition checked out in detached HEAD: it represents a specific SHA1 recorded as a gitlink in the parent repo index.
See "git submodule update" in order to make sure a submodule is tracking a branch:
# add submodule to track master branch
git submodule add -b master [URL to Git repo];
# update your submodule
git submodule update --remote 
# or (with rebase)
git submodule update --rebase --remote
Note: as shown here, any git submodule update command would automatically detach the HEAD, even if the submodule is configured to follow a branch.
As test add git config submodule.<name>.update merge, because by default, an update checks out the commit (detached HEAD)
user859375 adds in the comments:
The git submodule is detached in the init stage itself when running command "git submodule update --init --recursive".
I understand git refers and check-out particular commit of gitsubmodules.
So, we created a script to run "git submodule foreach git checkout master" and "git submodule foreach git pull origin master" among other things.
This way we're able to keep the attached head state when setting up repo in local machine.
And yes we run "git submodule update --remote --merge" when we need to update submodules to reflect changes in remote.