CVE-2026-31728

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop<br /> <br /> A race condition between gether_disconnect() and eth_stop() leads to a<br /> NULL pointer dereference. Specifically, if eth_stop() is triggered<br /> concurrently while gether_disconnect() is tearing down the endpoints,<br /> eth_stop() attempts to access the cleared endpoint descriptor, causing<br /> the following NPE:<br /> <br /> Unable to handle kernel NULL pointer dereference<br /> Call trace:<br /> __dwc3_gadget_ep_enable+0x60/0x788<br /> dwc3_gadget_ep_enable+0x70/0xe4<br /> usb_ep_enable+0x60/0x15c<br /> eth_stop+0xb8/0x108<br /> <br /> Because eth_stop() crashes while holding the dev-&gt;lock, the thread<br /> running gether_disconnect() fails to acquire the same lock and spins<br /> forever, resulting in a hardlockup:<br /> <br /> Core - Debugging Information for Hardlockup core(7)<br /> Call trace:<br /> queued_spin_lock_slowpath+0x94/0x488<br /> _raw_spin_lock+0x64/0x6c<br /> gether_disconnect+0x19c/0x1e8<br /> ncm_set_alt+0x68/0x1a0<br /> composite_setup+0x6a0/0xc50<br /> <br /> The root cause is that the clearing of dev-&gt;port_usb in<br /> gether_disconnect() is delayed until the end of the function.<br /> <br /> Move the clearing of dev-&gt;port_usb to the very beginning of<br /> gether_disconnect() while holding dev-&gt;lock. This cuts off the link<br /> immediately, ensuring eth_stop() will see dev-&gt;port_usb as NULL and<br /> safely bail out.