CVE-2026-31728

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop

A race condition between gether_disconnect() and eth_stop() leads to a

NULL pointer dereference. Specifically, if eth_stop() is triggered

concurrently while gether_disconnect() is tearing down the endpoints,

eth_stop() attempts to access the cleared endpoint descriptor, causing

the following NPE:

Unable to handle kernel NULL pointer dereference

Call trace:

__dwc3_gadget_ep_enable+0x60/0x788

dwc3_gadget_ep_enable+0x70/0xe4

usb_ep_enable+0x60/0x15c

eth_stop+0xb8/0x108

Because eth_stop() crashes while holding the dev->lock, the thread

running gether_disconnect() fails to acquire the same lock and spins

forever, resulting in a hardlockup:

Core - Debugging Information for Hardlockup core(7)

Call trace:

queued_spin_lock_slowpath+0x94/0x488

_raw_spin_lock+0x64/0x6c

gether_disconnect+0x19c/0x1e8

ncm_set_alt+0x68/0x1a0

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References