CVE-2026-31728: usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: uether: Fix race between getherdisconnect and ethstop
A race condition between getherdisconnect() and ethstop() leads to a NULL pointer dereference. Specifically, if ethstop() is triggered concurrently while getherdisconnect() is tearing down the endpoints, ethstop() attempts to access the cleared endpoint descriptor, causing the following NPE:
Unable to handle kernel NULL pointer dereference Call trace: dwc3gadgetepenable+0x60/0x788 dwc3gadgetepenable+0x70/0xe4 usbepenable+0x60/0x15c ethstop+0xb8/0x108
Because ethstop() crashes while holding the dev->lock, the thread running getherdisconnect() fails to acquire the same lock and spins forever, resulting in a hardlockup:
Core - Debugging Information for Hardlockup core(7) Call trace: queuedspinlockslowpath+0x94/0x488 rawspinlock+0x64/0x6c getherdisconnect+0x19c/0x1e8 ncmsetalt+0x68/0x1a0 compositesetup+0x6a0/0xc50
The root cause is that the clearing of dev->portusb in getherdisconnect() is delayed until the end of the function.
Move the clearing of dev->portusb to the very beginning of getherdisconnect() while holding dev->lock. This cuts off the link immediately, ensuring ethstop() will see dev->portusb as NULL and safely bail out.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the Linux kernel USB gadget u_ether component are exposed. The vector is local, and exploitation requires low privileges.
What conditions are required to trigger the failure?
eth_stop() must run concurrently with gether_disconnect() while the disconnect path is tearing down USB endpoints. Triggering the race is rated as high complexity.
What symptoms indicate that a system may have encountered this issue?
The system may report a kernel NULL pointer dereference in the USB gadget endpoint-enable path, including eth_stop(), followed by a hard lockup. The gether_disconnect() thread can spin waiting for dev->lock after eth_stop() crashes while holding that lock.