CVE-2026-31728

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: uether: Fix race between getherdisconnect and eth_stop

A race condition between getherdisconnect() and ethstop() leads to a NULL pointer dereference. Specifically, if ethstop() is triggered concurrently while getherdisconnect() is tearing down the endpoints, eth_stop() attempts to access the cleared endpoint descriptor, causing the following NPE:

Unable to handle kernel NULL pointer dereference Call trace: _dwc3gadgetepenable+0x60/0x788 dwc3gadgetepenable+0x70/0xe4 usbepenable+0x60/0x15c ethstop+0xb8/0x108

Because ethstop() crashes while holding the dev->lock, the thread running getherdisconnect() fails to acquire the same lock and spins forever, resulting in a hardlockup:

Core - Debugging Information for Hardlockup core(7) Call trace: queuedspinlockslowpath+0x94/0x488 rawspinlock+0x64/0x6c getherdisconnect+0x19c/0x1e8 ncmsetalt+0x68/0x1a0 compositesetup+0x6a0/0xc50

The root cause is that the clearing of dev->portusb in getherdisconnect() is delayed until the end of the function.

Move the clearing of dev->portusb to the very beginning of getherdisconnect() while holding dev->lock. This cuts off the link immediately, ensuring ethstop() will see dev->portusb as NULL and safely bail out.