CVE-2026-31727

usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo

Published May 1, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo

Commit ec35c1969650 ("usb: gadget: f_ncm: Fix net_device lifecycle with
device_move") reparents the gadget device to /sys/devices/virtual during
unbind, clearing the gadget pointer. If the userspace tool queries on
the surviving interface during this detached window, this leads to a
NULL pointer dereference.

Unable to handle kernel NULL pointer dereference
Call trace:
eth_get_drvinfo+0x50/0x90
ethtool_get_drvinfo+0x5c/0x1f0
__dev_ethtool+0xaec/0x1fe0
dev_ethtool+0x134/0x2e0
dev_ioctl+0x338/0x560

Add a NULL check for dev->gadget in eth_get_drvinfo(). When detached,
skip copying the fw_version and bus_info strings, which is natively
handled by ethtool_get_drvinfo for empty strings.

Analysis

Technical impact

A NULL pointer dereference in the eth_get_drvinfo function of the Linux kernel USB gadget u_ether driver can cause a kernel crash. When a userspace utility such as ethtool queries the driver during the device detach window, the function attempts to access the gadget pointer after it has been cleared, leading to a crash. The resulting kernel panic causes system downtime until a reboot. This flaw is a classic null pointer dereference (CWE‑476).

Affected Systems

All Linux kernel versions that contain the buggy u_ether gadget driver and have not been updated to include the fix commit ec35c1969650. The vulnerability affects the generic Linux kernel rather than specific vendor distributions, so any distribution shipping a kernel prior to the authority’s patch is potentially impacted.

Risk and Exploitability

The bug requires a userspace tool that invokes ethtool on a u_ether interface during detachment, which typically demands administrative privileges. No EPSS score is available, so the likelihood of exploitation is unknown, but the severity of a kernel panic makes it a high‑impact local fault. The vulnerability is not listed in the CISA KEV catalog, indicating that there is no publicly known exploit, but a malicious local actor could trigger it by unbinding a gadget interface while another process queries it. The CVSS score is 5.5, indicating moderate severity.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`7c97366f5dac5255e60a317ffe3a5b18f3745547`	affected	< f9f987472f4b8ab177be2b6492a59278ed969479
`36c41e9724c9a7a7cda37f5a4e9d94f25c8031c4`	affected	< 7fce959e9be3bf63bb0fdf4b05f9cc42cb289fe2
`93f116c3393a22acab96ad1bef12b2572eb80ca4`	affected	< 0326429e8ba99892e1d1e115dc8e88e1a3b64e24
`e584cb58a2ea7ff4d3a4bc43d5ca512ed3ecb77d`	affected	< a36e5e800b9c93e3e1ffa42f34d38b36775dbcee
`85acaba2f42b557499bab3608307f17bf13beb69`	affected	< 7de4d46be40738c7e48e64b5cc0a34aa1e047b0a
`ec35c1969650e7cb6c8a91020e568ed46e3551b0`	affected	< e002e92e88e12457373ed096b18716d97e7bbb20

Linux

unaffected

Version	Status	Constraints
`6.12.78`	affected	< 6.12.81
`6.18.19`	affected	< 6.18.22
`6.19.9`	affected	< 6.19.12

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc2::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc3::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc4::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc5::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc6::::::

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[93f116c3393a22acab96ad1bef12b2572eb80ca4,0326429e8ba99892e1d1e115dc8e88e1a3b64e24)`	affected	code_commit	—
`[e584cb58a2ea7ff4d3a4bc43d5ca512ed3ecb77d,a36e5e800b9c93e3e1ffa42f34d38b36775dbcee)`	affected	code_commit	—
`[85acaba2f42b557499bab3608307f17bf13beb69,7de4d46be40738c7e48e64b5cc0a34aa1e047b0a)`	affected	code_commit	—
`[ec35c1969650e7cb6c8a91020e568ed46e3551b0,e002e92e88e12457373ed096b18716d97e7bbb20)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[6.12.78,6.12.81)`	affected	semver	—
`[6.18.19,6.18.22)`	affected	semver	—
`[6.19.9,6.19.12)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Linux kernel to a version that includes commit ec35c1969650, which adds a NULL pointer check to eth_get_drvinfo.
Restrict or disable access to the ethtool utility for non‑privileged users when u_ether gadget devices may be unbound.
If an immediate kernel update is not possible, avoid querying u_ether interfaces with ethtool during the unbind operation or disable the u_ether gadget driver entirely if it is not needed for your workload.

Generated by OpenCVE AI on May 2, 2026 at 07:36 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.123% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0326429e8ba99892e1d1e115dc8e88e1a3b64e24
https://git.kernel.org/stable/c/7de4d46be40738c7e48e64b5cc0a34aa1e047b0a
https://git.kernel.org/stable/c/7fce959e9be3bf63bb0fdf4b05f9cc42cb289fe2
https://git.kernel.org/stable/c/a36e5e800b9c93e3e1ffa42f34d38b36775dbcee
https://git.kernel.org/stable/c/e002e92e88e12457373ed096b18716d97e7bbb20
https://git.kernel.org/stable/c/f9f987472f4b8ab177be2b6492a59278ed969479
https://lore.kernel.org/linux-cve-announce/2026050135-CVE-2026-31727-0070@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-31727
https://www.cve.org/CVERecord?id=CVE-2026-31727

History

Jun 19, 2026 12:45 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/7fce959e9be3bf63bb0fdf4b05f9cc42cb289fe2 https://git.kernel.org/stable/c/f9f987472f4b8ab177be2b6492a59278ed969479

May 7, 2026 4:30 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:o:linux:linux_kernel:7.0:rc1:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc2:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc3:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc4:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc5:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc6::::::

May 2, 2026 12:15 AM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026050135-CVE-2026-31727-0070@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-31727 https://www.cve.org/CVERecord?id=CVE-2026-31727
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

May 2, 2026 12:00 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-476

May 1, 2026 2:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo Commit ec35c1969650 ("usb: gadget: f_ncm: Fix net_device lifecycle with device_move") reparents the gadget device to /sys/devices/virtual during unbind, clearing the gadget pointer. If the userspace tool queries on the surviving interface during this detached window, this leads to a NULL pointer dereference. Unable to handle kernel NULL pointer dereference Call trace: eth_get_drvinfo+0x50/0x90 ethtool_get_drvinfo+0x5c/0x1f0 __dev_ethtool+0xaec/0x1fe0 dev_ethtool+0x134/0x2e0 dev_ioctl+0x338/0x560 Add a NULL check for dev->gadget in eth_get_drvinfo(). When detached, skip copying the fw_version and bus_info strings, which is natively handled by ethtool_get_drvinfo for empty strings.
Title		usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0326429e8ba99892e1d1e115dc8e88e1a3b64e24 https://git.kernel.org/stable/c/7de4d46be40738c7e48e64b5cc0a34aa1e047b0a https://git.kernel.org/stable/c/a36e5e800b9c93e3e1ffa42f34d38b36775dbcee https://git.kernel.org/stable/c/e002e92e88e12457373ed096b18716d97e7bbb20