{"api_version":"1","generated_at":"2026-07-23T16:45:26+00:00","cve":"CVE-2026-31727","urls":{"html":"https://cve.report/CVE-2026-31727","api":"https://cve.report/api/cve/CVE-2026-31727.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-31727","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-31727"},"summary":{"title":"usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo\n\nCommit ec35c1969650 (\"usb: gadget: f_ncm: Fix net_device lifecycle with\ndevice_move\") reparents the gadget device to /sys/devices/virtual during\nunbind, clearing the gadget pointer. If the userspace tool queries on\nthe surviving interface during this detached window, this leads to a\nNULL pointer dereference.\n\nUnable to handle kernel NULL pointer dereference\nCall trace:\n eth_get_drvinfo+0x50/0x90\n ethtool_get_drvinfo+0x5c/0x1f0\n __dev_ethtool+0xaec/0x1fe0\n dev_ethtool+0x134/0x2e0\n dev_ioctl+0x338/0x560\n\nAdd a NULL check for dev->gadget in eth_get_drvinfo(). When detached,\nskip copying the fw_version and bus_info strings, which is natively\nhandled by ethtool_get_drvinfo for empty strings.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-05-01 15:16:35","updated_at":"2026-06-19 13:16:27"},"problem_types":["CWE-476"],"metrics":[{"version":"3.1","source":"nvd@nist.gov","type":"Primary","score":"5.5","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"}}],"references":[{"url":"https://git.kernel.org/stable/c/0326429e8ba99892e1d1e115dc8e88e1a3b64e24","name":"https://git.kernel.org/stable/c/0326429e8ba99892e1d1e115dc8e88e1a3b64e24","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/e002e92e88e12457373ed096b18716d97e7bbb20","name":"https://git.kernel.org/stable/c/e002e92e88e12457373ed096b18716d97e7bbb20","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/a36e5e800b9c93e3e1ffa42f34d38b36775dbcee","name":"https://git.kernel.org/stable/c/a36e5e800b9c93e3e1ffa42f34d38b36775dbcee","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/f9f987472f4b8ab177be2b6492a59278ed969479","name":"https://git.kernel.org/stable/c/f9f987472f4b8ab177be2b6492a59278ed969479","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/7de4d46be40738c7e48e64b5cc0a34aa1e047b0a","name":"https://git.kernel.org/stable/c/7de4d46be40738c7e48e64b5cc0a34aa1e047b0a","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/7fce959e9be3bf63bb0fdf4b05f9cc42cb289fe2","name":"https://git.kernel.org/stable/c/7fce959e9be3bf63bb0fdf4b05f9cc42cb289fe2","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-31727","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31727","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 7c97366f5dac5255e60a317ffe3a5b18f3745547 f9f987472f4b8ab177be2b6492a59278ed969479 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 36c41e9724c9a7a7cda37f5a4e9d94f25c8031c4 7fce959e9be3bf63bb0fdf4b05f9cc42cb289fe2 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 93f116c3393a22acab96ad1bef12b2572eb80ca4 0326429e8ba99892e1d1e115dc8e88e1a3b64e24 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected e584cb58a2ea7ff4d3a4bc43d5ca512ed3ecb77d a36e5e800b9c93e3e1ffa42f34d38b36775dbcee git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 85acaba2f42b557499bab3608307f17bf13beb69 7de4d46be40738c7e48e64b5cc0a34aa1e047b0a git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ec35c1969650e7cb6c8a91020e568ed46e3551b0 e002e92e88e12457373ed096b18716d97e7bbb20 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.12.78 6.12.81 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.18.19 6.18.22 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.19.9 6.19.12 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2026","cve_id":"31727","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"linux","cpe5":"linux_kernel","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"31727","cve":"CVE-2026-31727","epss":"0.000180000","percentile":"0.046430000","score_date":"2026-05-05","updated_at":"2026-05-06 00:08:10"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/gadget/function/u_ether.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f9f987472f4b8ab177be2b6492a59278ed969479","status":"affected","version":"7c97366f5dac5255e60a317ffe3a5b18f3745547","versionType":"git"},{"lessThan":"7fce959e9be3bf63bb0fdf4b05f9cc42cb289fe2","status":"affected","version":"36c41e9724c9a7a7cda37f5a4e9d94f25c8031c4","versionType":"git"},{"lessThan":"0326429e8ba99892e1d1e115dc8e88e1a3b64e24","status":"affected","version":"93f116c3393a22acab96ad1bef12b2572eb80ca4","versionType":"git"},{"lessThan":"a36e5e800b9c93e3e1ffa42f34d38b36775dbcee","status":"affected","version":"e584cb58a2ea7ff4d3a4bc43d5ca512ed3ecb77d","versionType":"git"},{"lessThan":"7de4d46be40738c7e48e64b5cc0a34aa1e047b0a","status":"affected","version":"85acaba2f42b557499bab3608307f17bf13beb69","versionType":"git"},{"lessThan":"e002e92e88e12457373ed096b18716d97e7bbb20","status":"affected","version":"ec35c1969650e7cb6c8a91020e568ed46e3551b0","versionType":"git"}]},{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/gadget/function/u_ether.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6.12.81","status":"affected","version":"6.12.78","versionType":"semver"},{"lessThan":"6.18.22","status":"affected","version":"6.18.19","versionType":"semver"},{"lessThan":"6.19.12","status":"affected","version":"6.19.9","versionType":"semver"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.81","versionStartIncluding":"6.12.78","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.22","versionStartIncluding":"6.18.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19.9","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo\n\nCommit ec35c1969650 (\"usb: gadget: f_ncm: Fix net_device lifecycle with\ndevice_move\") reparents the gadget device to /sys/devices/virtual during\nunbind, clearing the gadget pointer. If the userspace tool queries on\nthe surviving interface during this detached window, this leads to a\nNULL pointer dereference.\n\nUnable to handle kernel NULL pointer dereference\nCall trace:\n eth_get_drvinfo+0x50/0x90\n ethtool_get_drvinfo+0x5c/0x1f0\n __dev_ethtool+0xaec/0x1fe0\n dev_ethtool+0x134/0x2e0\n dev_ioctl+0x338/0x560\n\nAdd a NULL check for dev->gadget in eth_get_drvinfo(). When detached,\nskip copying the fw_version and bus_info strings, which is natively\nhandled by ethtool_get_drvinfo for empty strings."}],"providerMetadata":{"dateUpdated":"2026-06-19T11:58:05.053Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/f9f987472f4b8ab177be2b6492a59278ed969479"},{"url":"https://git.kernel.org/stable/c/7fce959e9be3bf63bb0fdf4b05f9cc42cb289fe2"},{"url":"https://git.kernel.org/stable/c/0326429e8ba99892e1d1e115dc8e88e1a3b64e24"},{"url":"https://git.kernel.org/stable/c/a36e5e800b9c93e3e1ffa42f34d38b36775dbcee"},{"url":"https://git.kernel.org/stable/c/7de4d46be40738c7e48e64b5cc0a34aa1e047b0a"},{"url":"https://git.kernel.org/stable/c/e002e92e88e12457373ed096b18716d97e7bbb20"}],"title":"usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-31727","datePublished":"2026-05-01T14:14:27.552Z","dateReserved":"2026-03-09T15:48:24.134Z","dateUpdated":"2026-06-19T11:58:05.053Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-05-01 15:16:35","lastModifiedDate":"2026-06-19 13:16:27","problem_types":["CWE-476"],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12.78","versionEndExcluding":"6.12.81","matchCriteriaId":"3567D859-58AE-4093-AF8D-4FAF8C4F6486"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.18.19","versionEndExcluding":"6.18.22","matchCriteriaId":"FFB8FEEE-92ED-46DD-897B-15F8534FE743"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19.9","versionEndExcluding":"6.19.12","matchCriteriaId":"F44F6C4F-96C5-4F3A-8DA1-9B8F6AB14C51"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"31727","Ordinal":"1","Title":"usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo","CVE":"CVE-2026-31727","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"31727","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo\n\nCommit ec35c1969650 (\"usb: gadget: f_ncm: Fix net_device lifecycle with\ndevice_move\") reparents the gadget device to /sys/devices/virtual during\nunbind, clearing the gadget pointer. If the userspace tool queries on\nthe surviving interface during this detached window, this leads to a\nNULL pointer dereference.\n\nUnable to handle kernel NULL pointer dereference\nCall trace:\n eth_get_drvinfo+0x50/0x90\n ethtool_get_drvinfo+0x5c/0x1f0\n __dev_ethtool+0xaec/0x1fe0\n dev_ethtool+0x134/0x2e0\n dev_ioctl+0x338/0x560\n\nAdd a NULL check for dev->gadget in eth_get_drvinfo(). When detached,\nskip copying the fw_version and bus_info strings, which is natively\nhandled by ethtool_get_drvinfo for empty strings.","Type":"Description","Title":"usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo"}]}}}