CVE-2026-43421

What it actually does

This flaw affects the Linux kernel USB gadget NCM function (f_ncm). During USB gadget disconnect, unbind, or rebind cycles, the associated network device can outlive its parent gadget device, leaving dangling sysfs relationships and creating conditions for a kernel null pointer dereference. A local user with the ability to interact with or reconfigure USB gadget functionality can trigger a denial of service by causing the kernel to crash or destabilize during gadget lifecycle transitions. The impact is availability-only; the vulnerability does not directly provide confidentiality loss, integrity modification, or privilege escalation based on the provided scoring and description.

Why it matters to the business

Systems that rely on Linux USB gadget networking can crash or become unavailable if the vulnerable gadget lifecycle path is triggered. This is most relevant to embedded Linux devices, mobile or development platforms, appliances, kiosks, USB networking devices, and systems using configfs-based USB gadget configurations. Operational consequences may include device outages, interrupted USB network connectivity, failed DHCP behavior, service disruption, and manual recovery requirements. The issue is not currently listed in CISA KEV, is not known to be used in ransomware campaigns, and has very low EPSS, so broad internet-scale exploitation is unlikely; however, organizations using USB gadget mode should still prioritize kernel updates because local denial-of-service bugs can be impactful on unattended or physically exposed devices.

How an attack unfolds

An attacker first needs local access to a vulnerable Linux system and sufficient permissions to interact with USB gadget configuration, typically through configfs or scripts/services that manage USB gadget functions. The attacker configures or manipulates a USB gadget using the NCM networking function, then repeatedly triggers bind, unbind, disconnect, or reconnect operations. On vulnerable kernels, the net_device lifecycle can become inconsistent with the parent gadget device lifecycle, leaving dangling sysfs links. When the kernel later follows this invalid relationship during gadget teardown or reconfiguration, it can hit a null pointer dereference and crash, resulting in local denial of service. There is no indication from the provided data that this vulnerability is remotely exploitable, exploited in the wild, or associated with named threat actors.

How to fix it

Upgrade to a Linux kernel version that includes the fix for the USB gadget f_ncm net_device lifecycle issue. The fix reparents the network device using device_move during bind and unbind cycles and introduces helper logic to correctly attach and detach the gadget device. No exact fixed package versions were provided, so remediation should be performed by applying the relevant vendor kernel update for CVE-2026-43421 or by backporting the upstream patch into maintained kernels. Where immediate patching is not possible, reduce exposure by disabling unused USB gadget functionality, removing or blocking use of the NCM gadget function, restricting write access to configfs USB gadget paths, limiting local shell access, and preventing untrusted users from invoking gadget-management services or scripts. Embedded and appliance vendors should verify that their kernel branch includes the lifecycle fix rather than relying only on generic version checks.

How to confirm the fix worked

Confirm the running kernel includes the vendor fix for the USB gadget f_ncm lifecycle issue. Validate with the OS or device vendor advisory, installed kernel package changelog, or source tree review for the f_ncm/gether lifecycle changes involving device_move, gether_attach_gadget(), and gether_detach_gadget(). On systems where USB gadget mode is used, perform controlled regression testing of NCM gadget bind, unbind, disconnect, and reconnect cycles while monitoring kernel logs for null pointer dereferences, sysfs warnings, oops messages, or device lifecycle errors. Confirm that the NCM network interface remains stable across USB reconnects and that DHCP or USB network services continue to bind correctly. If USB gadget functionality is not required, validate that configfs gadget paths are absent, disabled, or inaccessible to non-administrative users.

Typical attack path

1. Obtain local access to a vulnerable Linux system where USB gadget functionality is enabled or available.
2. Gain permission to modify USB gadget configuration, commonly through configfs or a privileged helper managing gadget setup.
3. Create or use a USB gadget configuration that includes the NCM networking function, often exposed through f_ncm or usb_f_ncm behavior.
4. Trigger USB gadget bind, unbind, disconnect, or reconnect cycles repeatedly.
5. Cause the network device and parent gadget device lifecycle to become inconsistent, resulting in dangling sysfs relationships.
6. Trigger the vulnerable kernel path that dereferences an invalid or null device pointer.
7. Crash or destabilize the kernel, causing local denial of service and interruption of USB networking or device operation.

How to detect it

To assess whether this was already exploited, review kernel and system logs for crashes or oops events occurring around USB gadget NCM configuration, USB disconnect/reconnect activity, or configfs gadget changes. Relevant log sources include dmesg, journald, /var/log/kern.log, /var/log/messages, crash dumps, pstore/ramoops, kdump/vmcore data, audit logs for configfs writes, and service logs for USB gadget setup scripts. Look for sequences where f_ncm, usb_f_ncm, NCM gadget, or usb_gadget activity is followed by a null pointer dereference, kernel oops, panic, watchdog reset, or unexpected reboot. Also investigate repeated writes under /sys/kernel/config/usb_gadget, unusual gadget bind/unbind activity through the UDC attribute, or repeated creation/removal of NCM functions. There are no public threat actor or campaign-specific indicators in the provided data, so detection should focus on behavioral evidence of local triggering and post-crash artifacts rather than network indicators.

• f_ncm
• usb_f_ncm
• usb_gadget
• /sys/kernel/config/usb_gadget
• /sys/kernel/config/usb_gadget/*/UDC
• /sys/kernel/config/usb_gadget/*/functions/ncm
• NULL pointer dereference
• BUG: kernel NULL pointer dereference
• Oops:
• Kernel panic
• Unable to handle kernel NULL pointer dereference
• device_move
• gether_attach_gadget
• gether_detach_gadget
• NO-CARRIER

What your security team should do

• Identify Linux systems, embedded devices, appliances, and development boards that use USB gadget mode, especially NCM networking via configfs.
• Prioritize patching for physically exposed, kiosk-like, embedded, mobile, lab, or appliance systems where local users may be able to trigger USB gadget reconfiguration or reconnection.
• Apply the vendor-provided kernel update or backport the upstream f_ncm net_device lifecycle fix where vendor packages are not yet available.
• Temporarily disable USB gadget NCM functionality if it is not business-critical.
• Restrict access to /sys/kernel/config/usb_gadget and any gadget-management scripts, services, udev rules, or automation to trusted administrators only.
• Monitor kernel logs for USB gadget f_ncm errors, null pointer dereferences, kernel oops events, and unexpected reboots on systems using USB gadget networking.
• Because the vulnerability is not in KEV, has no known ransomware association, and has low EPSS, treat it as targeted/local-risk remediation rather than an internet-wide emergency unless the affected device class is operationally critical.