CVE-2026-31727

The record

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo Commit ec35c1969650 ("usb: gadget: f_ncm: Fix net_device lifecycle with device_move") reparents the gadget device to /sys/devices/virtual during unbind, clearing the gadget pointer. If the userspace tool queries on the surviving interface during this detached window, this leads to a NULL pointer dereference. Unable to handle kernel NULL pointer dereference Call trace: eth_get_drvinfo+0x50/0x90 ethtool_get_drvinfo+0x5c/0x1f0 __dev_ethtool+0xaec/0x1fe0 dev_ethtool+0x134/0x2e0 dev_ioctl+0x338/0x560 Add a NULL check for dev->gadget in eth_get_drvinfo(). When detached, skip copying the fw_version and bus_info strings, which is natively handled by ethtool_get_drvinfo for empty strings.

Affected packages

Related vulnerabilities

• CVE-2026-62966 ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32… CWE-476
• CVE-2026-59993 Picotls is a TLS protocol library that allows users select different crypto backends… CWE-476
• CVE-2026-62298 mouse07410/asn1c is an ASN.1 compiler. CWE-476
• CVE-2026-119842 A flaw was found in GStreamer's gst-plugins-base MicroDVD subtitle parser. CWE-476
• CVE-2026-120046 Nezha 2.0.0 before 2.4.0 contains a NULL pointer dereference vulnerability in… CWE-476
• CVE-2026-119728 A flaw was found in the H.264 video parser in gst-plugins-bad. CWE-476
• CVE-2026-119760 sniproxy through 0.7.0 contains a NULL pointer dereference vulnerability in… CWE-476
• CVE-2026-105924 A NULL pointer dereference vulnerability in the Qt QCborValue to JSON conversion of the… CWE-476