Answer in brief
CVE-2026-31727 records a Medium severity (CVSS 5.5) vulnerability in usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=7c97366f5dac5255e60a317ffe3a5b18f3745547 <f9f987472f4b8ab177be2b6492a59278ed969479 || >=36c41e9724c9a7a7cda37f5a4e9d94f25c8031c4 <7fce959e9be3bf63bb0fdf4b05f9cc42cb289fe2 || >=93f116c3393a22acab96ad1bef12b2572eb80ca4 <0326429e8ba99892e1d1e115dc8e88e1a3b64e24 || >=e584cb58a2ea7ff4d3a4bc43d5ca512ed3ecb77d <a36e5e800b9c93e3e1ffa42f34d38b36775dbcee || >=85acaba2f42b557499bab3608307f17bf13beb69 <7de4d46be40738c7e48e64b5cc0a34aa1e047b0a || >=ec35c1969650e7cb6c8a91020e568ed46e3551b0 <e002e92e88e12457373ed096b18716d97e7bbb20 | f9f987472f4b8ab177be2b6492a59278ed969479, 7fce959e9be3bf63bb0fdf4b05f9cc42cb289fe2, 0326429e8ba99892e1d1e115dc8e88e1a3b64e24, a36e5e800b9c93e3e1ffa42f34d38b36775dbcee, 7de4d46be40738c7e48e64b5cc0a34aa1e047b0a, e002e92e88e12457373ed096b18716d97e7bbb20 |
| Linux/Linuxgeneric | >=6.12.78 <6.12.81 || >=6.18.19 <6.18.22 || >=6.19.9 <6.19.12 | 6.12.81, 6.18.22, 6.19.12 |
Published upstream
May 1, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jun 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 19, 2026
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo Commit ec35c1969650 ("usb: gadget: f_ncm: Fix net_device lifecycle with device_move") reparents the gadget device to /sys/devices/virtual during unbind, clearing the gadget pointer. If the userspace tool queries on the surviving interface during this detached window, this leads to a NULL pointer dereference. Unable to handle kernel NULL pointer dereference Call trace: eth_get_drvinfo+0x50/0x90 ethtool_get_drvinfo+0x5c/0x1f0 __dev_ethtool+0xaec/0x1fe0 dev_ethtool+0x134/0x2e0 dev_ioctl+0x338/0x560 Add a NULL check for dev->gadget in eth_get_drvinfo(). When detached, skip copying the fw_version and bus_info strings, which is natively handled by ethtool_get_drvinfo for empty strings.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-31727 records a Medium severity (CVSS 5.5) vulnerability in usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=7c97366f5dac5255e60a317ffe3a5b18f3745547 <f9f987472f4b8ab177be2b6492a59278ed969479 || >=36c41e9724c9a7a7cda37f5a4e9d94f25c8031c4 <7fce959e9be3bf63bb0fdf4b05f9cc42cb289fe2 || >=93f116c3393a22acab96ad1bef12b2572eb80ca4 <0326429e8ba99892e1d1e115dc8e88e1a3b64e24 || >=e584cb58a2ea7ff4d3a4bc43d5ca512ed3ecb77d <a36e5e800b9c93e3e1ffa42f34d38b36775dbcee || >=85acaba2f42b557499bab3608307f17bf13beb69 <7de4d46be40738c7e48e64b5cc0a34aa1e047b0a || >=ec35c1969650e7cb6c8a91020e568ed46e3551b0 <e002e92e88e12457373ed096b18716d97e7bbb20 | f9f987472f4b8ab177be2b6492a59278ed969479, 7fce959e9be3bf63bb0fdf4b05f9cc42cb289fe2, 0326429e8ba99892e1d1e115dc8e88e1a3b64e24, a36e5e800b9c93e3e1ffa42f34d38b36775dbcee, 7de4d46be40738c7e48e64b5cc0a34aa1e047b0a, e002e92e88e12457373ed096b18716d97e7bbb20 |
| Linux/Linuxgeneric | >=6.12.78 <6.12.81 || >=6.18.19 <6.18.22 || >=6.19.9 <6.19.12 | 6.12.81, 6.18.22, 6.19.12 |
Published upstream
May 1, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jun 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 19, 2026
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo Commit ec35c1969650 ("usb: gadget: f_ncm: Fix net_device lifecycle with device_move") reparents the gadget device to /sys/devices/virtual during unbind, clearing the gadget pointer. If the userspace tool queries on the surviving interface during this detached window, this leads to a NULL pointer dereference. Unable to handle kernel NULL pointer dereference Call trace: eth_get_drvinfo+0x50/0x90 ethtool_get_drvinfo+0x5c/0x1f0 __dev_ethtool+0xaec/0x1fe0 dev_ethtool+0x134/0x2e0 dev_ioctl+0x338/0x560 Add a NULL check for dev->gadget in eth_get_drvinfo(). When detached, skip copying the fw_version and bus_info strings, which is natively handled by ethtool_get_drvinfo for empty strings.
Quoted source text, attributed separately from HOL analysis.