CVE-2026-31727 usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo
A local attacker can trigger a kernel crash by querying network interface info during USB gadget unbinding, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-31727?
CVE-2026-31727 is a medium-severity vulnerability in Linux kernel, published on 1 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo
Commit ec35c1969650 ("usb: gadget: f_ncm: Fix net_device lifecycle with device_move") reparents the gadget device to /sys/devices/virtual during unbind, clearing the gadget pointer. If the userspace tool queries on the surviving interface during this detached window, this leads to a NULL pointer dereference.
Unable to handle kernel NULL pointer dereference Call trace: eth_get_drvinfo+0x50/0x90 ethtool_get_drvinfo+0x5c/0x1f0 __dev_ethtool+0xaec/0x1fe0 dev_ethtool+0x134/0x2e0 dev_ioctl+0x338/0x560
Add a NULL check for dev->gadget in eth_get_drvinfo(). When detached, skip copying the fw_version and bus_info strings, which is natively handled by ethtool_get_drvinfo for empty strings.
Weakness: CWE-476
Which versions are affected by CVE-2026-31727?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-31727?
Apply the vendor's patch.
Is CVE-2026-31727 being exploited?
There is no known exploitation of CVE-2026-31727 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-31727, DEBIAN-CVE-2026-31727, GHSA-8j24-6c4v-7q4p, UBUNTU-CVE-2026-31727.