Junglewise Threat Intelligence

CVE-2026-31727: Linux Kernel NULL pointer dereference in usb gadget u_ether

CVE-2026-31727 · Severity: medium · CVSS 5.5 · Published 2026-05-01

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's USB networking component could allow a local user to crash the system. When certain USB networking devices are disconnected, a brief timing window exists where system diagnostic tools can trigger a critical error. This results in a system crash (kernel panic), impacting the availability of the affected machine.

Technical details

A NULL pointer dereference exists in the 'u_ether' USB gadget driver within the 'eth_get_drvinfo' function. The vulnerability is triggered when a gadget device is reparented to virtual devices during an unbind operation, which clears the gadget pointer. If a userspace tool (such as ethtool) queries the interface via ioctl during this specific window, the kernel attempts to access the cleared pointer. This issue was introduced by a previous lifecycle management fix (commit ec35c1969650). The fix adds a NULL check for the gadget pointer before accessing its members. Patching is available in various stable kernel branches.

Affected products

  • Linux Linux Kernel 6.12.78 to 6.12.81, 6.18.19 to 6.18.22, 6.19.9 to 6.19.12

Timeline

  • 2026-05-01: advisory: Initial publication of the CVE record.
  • 2026-04-11: patched: Fix committed to stable kernel trees.

References

Related threats