CVE-2026-31727

usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo

published May 1, 2026

CVSS
—
EPSS
0%
Percentile
5.1
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo

Commit ec35c1969650 ("usb: gadget: f_ncm: Fix net_device lifecycle with

device_move") reparents the gadget device to /sys/devices/virtual during

unbind, clearing the gadget pointer. If the userspace tool queries on

the surviving interface during this detached window, this leads to a

NULL pointer dereference.

Unable to handle kernel NULL pointer dereference

Call trace:

eth_get_drvinfo+0x50/0x90

ethtool_get_drvinfo+0x5c/0x1f0

__dev_ethtool+0xaec/0x1fe0

dev_ethtool+0x134/0x2e0

dev_ioctl+0x338/0x560

Add a NULL check for dev->gadget in eth_get_drvinfo(). When detached,

skip copying the fw_version and bus_info strings, which is natively

handled by ethtool_get_drvinfo for empty strings.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00162 · 5.1th percentile
Published
2026-05-01T14:14Z
EPSS history
Timeline
  • 01 MAY 14:14Z
    usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo
    cvelistv5