CVE-2026-31727

Source
https://cve.org/CVERecord?id=CVE-2026-31727
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-31727.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-31727
Downstream
Related
Published
2026-05-01T14:14:27.552Z
Modified
2026-08-25T18:27:30.375209993Z
Summary
usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo
Details

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: uether: Fix NULL pointer deref in ethget_drvinfo

Commit ec35c1969650 ("usb: gadget: fncm: Fix netdevice lifecycle with device_move") reparents the gadget device to /sys/devices/virtual during unbind, clearing the gadget pointer. If the userspace tool queries on the surviving interface during this detached window, this leads to a NULL pointer dereference.

Unable to handle kernel NULL pointer dereference Call trace: ethgetdrvinfo+0x50/0x90 ethtoolgetdrvinfo+0x5c/0x1f0 _devethtool+0xaec/0x1fe0 devethtool+0x134/0x2e0 devioctl+0x338/0x560

Add a NULL check for dev->gadget in ethgetdrvinfo(). When detached, skip copying the fwversion and businfo strings, which is natively handled by ethtoolgetdrvinfo for empty strings.

Database specific
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31727.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
7c97366f5dac5255e60a317ffe3a5b18f3745547
Fixed
f9f987472f4b8ab177be2b6492a59278ed969479
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
36c41e9724c9a7a7cda37f5a4e9d94f25c8031c4
Fixed
7fce959e9be3bf63bb0fdf4b05f9cc42cb289fe2
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
93f116c3393a22acab96ad1bef12b2572eb80ca4
Fixed
0326429e8ba99892e1d1e115dc8e88e1a3b64e24
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
e584cb58a2ea7ff4d3a4bc43d5ca512ed3ecb77d
Fixed
a36e5e800b9c93e3e1ffa42f34d38b36775dbcee
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
85acaba2f42b557499bab3608307f17bf13beb69
Fixed
7de4d46be40738c7e48e64b5cc0a34aa1e047b0a
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
ec35c1969650e7cb6c8a91020e568ed46e3551b0
Fixed
e002e92e88e12457373ed096b18716d97e7bbb20

Affected versions

v6.*
v6.12.78
v6.12.79
v6.12.80
v6.18.19
v6.18.20
v6.18.21
v6.19.10
v6.19.11
v6.19.9

Database specific

source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-31727.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.12.78
Fixed
6.12.81
Type
ECOSYSTEM
Events
Introduced
6.18.19
Fixed
6.18.22
Type
ECOSYSTEM
Events
Introduced
6.19.9
Fixed
6.19.12

Database specific

source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-31727.json"