CVE-2026-43421 usb: gadget: f_ncm: Fix net_device lifecycle with device_move
A null pointer dereference in the Linux kernel USB NCM gadget driver can cause a system crash during device disconnection.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43421?
CVE-2026-43421 is a medium-severity vulnerability in Linux kernel, published on 8 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: f_ncm: Fix net_device lifecycle with device_move
The network device outlived its parent gadget device during disconnection, resulting in dangling sysfs links and null pointer dereference problems.
A prior attempt to solve this by removing SET_NETDEV_DEV entirely [1] was reverted due to power management ordering concerns and a NO-CARRIER regression.
A subsequent attempt to defer net_device allocation to bind [2] broke 1:1 mapping between function instance and network device, making it impossible for configfs to report the resolved interface name. This results in a regression where the DHCP server fails on pmOS.
Use device_move to reparent the net_device between the gadget device and /sys/devices/virtual/ across bind/unbind cycles. This preserves the network interface across USB reconnection, allowing the DHCP server to retain their binding.
Introduce gether_attach_gadget()/gether_detach_gadget() helpers and use __free(detach_gadget) macro to undo attachment on bind failure. The bind_count ensures device_move executes only on the first bind.
[1] https://lore.kernel.org/lkml/[email protected]/ [2] https://lore.kernel.org/linux-usb/[email protected]/
Weakness: CWE-476
Which versions are affected by CVE-2026-43421?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-43421?
Apply the vendor's patch.
Is CVE-2026-43421 being exploited?
There is no known exploitation of CVE-2026-43421 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-43421, DEBIAN-CVE-2026-43421, GHSA-w77g-4c35-prwp, ROOT-OS-DEBIAN-11-CVE-2026-43421, ROOT-OS-DEBIAN-12-CVE-2026-43421, ROOT-OS-UBUNTU-2204-CVE-2026-43421 and 2 more.