A NULL pointer dereference in the eth_get_drvinfo function of the Linux kernel USB gadget u_ether driver can cause a kernel crash. When a userspace utility such as ethtool queries the driver during the device detach window, the function attempts to access the gadget pointer after it has been cleared, leading to a crash. The resulting kernel panic causes system downtime until a reboot. This flaw is a classic null pointer dereference (CWE‑476).

All Linux kernel versions that contain the buggy u_ether gadget driver and have not been updated to include the fix commit ec35c1969650. The vulnerability affects the generic Linux kernel rather than specific vendor distributions, so any distribution shipping a kernel prior to the authority’s patch is potentially impacted.

The bug requires a userspace tool that invokes ethtool on a u_ether interface during detachment, which typically demands administrative privileges. No EPSS score is available, so the likelihood of exploitation is unknown, but the severity of a kernel panic makes it a high‑impact local fault. The vulnerability is not listed in the CISA KEV catalog, indicating that there is no publicly known exploit, but a malicious local actor could trigger it by unbinding a gadget interface while another process queries it. The CVSS score is 5.5, indicating moderate severity.