In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop
A race condition between gether_disconnect() and eth_stop() leads to a
NULL pointer dereference. Specifically, if eth_stop() is triggered
concurrently while gether_disconnect() is tearing down the endpoints,
eth_stop() attempts to access the cleared endpoint descriptor, causing
the following NPE:
Unable to handle kernel NULL pointer dereference
Call trace:
__dwc3_gadget_ep_enable+0x60/0x788
dwc3_gadget_ep_enable+0x70/0xe4
usb_ep_enable+0x60/0x15c
eth_stop+0xb8/0x108
Because eth_stop() crashes while holding the dev->lock, the thread
running gether_disconnect() fails to acquire the same lock and spins
forever, resulting in a hardlockup:
Core - Debugging Information for Hardlockup core(7)
Call trace:
queued_spin_lock_slowpath+0x94/0x488
_raw_spin_lock+0x64/0x6c
gether_disconnect+0x19c/0x1e8
ncm_set_alt+0x68/0x1a0
composite_setup+0x6a0/0xc50
The root cause is that the clearing of dev->port_usb in
gether_disconnect() is delayed until the end of the function.
Move the clearing of dev->port_usb to the very beginning of
gether_disconnect() while holding dev->lock. This cuts off the link
immediately, ensuring eth_stop() will see dev->port_usb as NULL and
safely bail out.
References
Configurations
Configuration 1 (hide)
|
History
07 May 2026, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-362 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.7 |
| CPE | cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:* |
|
| First Time |
Linux linux Kernel
Linux |
|
| References | () https://git.kernel.org/stable/c/6ad77458637b78ec655e3da5f112c862e6690a9d - Patch | |
| References | () https://git.kernel.org/stable/c/8ff689edfeceb5e3ec1623e09af2b2aa0f1098a8 - Patch | |
| References | () https://git.kernel.org/stable/c/a259ba0bce3b192c04334499690372a250f7d0b1 - Patch | |
| References | () https://git.kernel.org/stable/c/bbb09bb89ffa571475f66daca9482b974cd29d6a - Patch | |
| References | () https://git.kernel.org/stable/c/e1e7a66584bf0aff3becb73c19fa31527889fc9e - Patch | |
| References | () https://git.kernel.org/stable/c/e1eabb072c75681f78312c484ccfffb7430f206e - Patch | |
| References | () https://git.kernel.org/stable/c/f02980594deef751e42133714aee25228f1494c6 - Patch | |
| References | () https://git.kernel.org/stable/c/f6813c2b2ae78def76b69e0f9d72f80e4a1c4aca - Patch |
01 May 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-01 15:16
Updated : 2026-06-17 10:34
NVD link : CVE-2026-31728
Mitre link : CVE-2026-31728
CVE.ORG link : CVE-2026-31728
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')