CVE-2026-31727

MediumCVSS 5.5/10Last modified Jun 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo

Commit ec35c1969650 ("usb: gadget: f_ncm: Fix net_device lifecycle with device_move") reparents the gadget device to /sys/devices/virtual during unbind, clearing the gadget pointer. If the userspace tool queries on the surviving interface during this detached window, this leads to a NULL pointer dereference.

Unable to handle kernel NULL pointer dereference Call trace: eth_get_drvinfo+0x50/0x90 ethtool_get_drvinfo+0x5c/0x1f0 __dev_ethtool+0xaec/0x1fe0 dev_ethtool+0x134/0x2e0 dev_ioctl+0x338/0x560

Add a NULL check for dev->gadget in eth_get_drvinfo(). When detached, skip copying the fw_version and bus_info strings, which is natively handled by ethtool_get_drvinfo for empty strings.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

VendorProductVersions
LinuxLinux>= 7c97366f5dac5255e60a317ffe3a5b18f3745547, < f9f987472f4b8ab177be2b6492a59278ed969479; >= 36c41e9724c9a7a7cda37f5a4e9d94f25c8031c4, < 7fce959e9be3bf63bb0fdf4b05f9cc42cb289fe2; >= 93f116c3393a22acab96ad1bef12b2572eb80ca4, < 0326429e8ba99892e1d1e115dc8e88e1a3b64e24; >= e584cb58a2ea7ff4d3a4bc43d5ca512ed3ecb77d, < a36e5e800b9c93e3e1ffa42f34d38b36775dbcee; >= 85acaba2f42b557499bab3608307f17bf13beb69, < 7de4d46be40738c7e48e64b5cc0a34aa1e047b0a; >= ec35c1969650e7cb6c8a91020e568ed46e3551b0, < e002e92e88e12457373ed096b18716d97e7bbb20
LinuxLinux>= 6.12.78, < 6.12.81; >= 6.18.19, < 6.18.22; >= 6.19.9, < 6.19.12

References

Timeline

Published
May 1, 2026
Last modified
Jun 19, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-317284.7In the Linux kernel, the following vulnerability has been resolved: usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop CVE-2026-317297.8In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: validate connector number in ucsi_notify_common() ThCVE-2026-31736.5The Meta Field Block plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.5.1. ThiCVE-2026-317307.8In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: possible double-free of cctx->remote_heap fastrpc_init_CVE-2026-317317.8In the Linux kernel, the following vulnerability has been resolved: thermal: core: Address thermal zone removal races with resume Since thCVE-2026-317325.5In the Linux kernel, the following vulnerability has been resolved: gpio: Fix resource leaks on errors in gpiochip_add_data_with_key() SinCVE-2026-317335.5In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix stale direct dispatch state in ddsp_dsq_id @p->scx.ddspCVE-2026-317345.5In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix is_bpf_migration_disabled() false negative on non-PREEMPCVE-2026-317358.8In the Linux kernel, the following vulnerability has been resolved: iommupt: Fix short gather if the unmap goes into a large mapping unmapCVE-2026-317365.5In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled If theCVE-2026-317375.5In the Linux kernel, the following vulnerability has been resolved: net: ftgmac100: fix ring allocation unwind on open failure ftgmac100_aCVE-2026-317385.5In the Linux kernel, the following vulnerability has been resolved: vxlan: validate ND option lengths in vxlan_na_create vxlan_na_create()
CVE-2026-31727: Medium severity, CVSS 5.5 | Vulnix