CVE-2026-43421: Linux Kernel Use-After-Free Vulnerability

CVE-2026-43421 Overview

CVE-2026-43421 is a Linux kernel vulnerability in the USB gadget NCM (Network Control Model) function driver f_ncm. The flaw involves improper lifecycle management of the network device relative to its parent gadget device. During USB disconnection, the net_device outlived its parent gadget device, producing dangling sysfs links and null pointer dereference conditions. The issue stems from incorrect device parent reference handling across bind and unbind cycles in the USB gadget subsystem. The vulnerability has been resolved in mainline Linux through a fix that uses device_move to reparent the net_device between the gadget device and /sys/devices/virtual/.

Critical Impact
Local null pointer dereference and dangling sysfs references during USB gadget disconnect can lead to kernel instability and denial of service on affected systems.

Affected Products

Linux kernel versions implementing the USB gadget f_ncm function driver
Linux distributions shipping vulnerable stable kernel branches
Embedded and mobile systems using USB NCM gadget mode (for example, pmOS deployments referenced in the upstream report)

Discovery Timeline

2026-05-08 - CVE-2026-43421 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-43421

Vulnerability Analysis

The vulnerability resides in the USB gadget NCM function driver (drivers/usb/gadget/function/f_ncm.c). The net_device allocated by the NCM gadget retained references to its parent gadget device after the gadget was torn down. When disconnection occurred, the network device outlived its parent, leaving sysfs symbolic links pointing to freed device structures. Subsequent access to those stale references triggered null pointer dereferences in kernel context. Prior remediation attempts introduced regressions: removing SET_NETDEV_DEV produced power management ordering issues and a NO-CARRIER regression, while deferring net_device allocation to bind broke the 1:1 mapping between function instance and network device, preventing configfs from reporting the resolved interface name and causing DHCP server failures.

Root Cause

The root cause is a mismatch between the lifecycle of the parent gadget device and the child net_device across bind and unbind operations. The network device was registered with the gadget as its sysfs parent but persisted beyond gadget teardown. Without explicit reparenting, the kernel left sysfs links and device pointers in an inconsistent state, classifying this as a use-after-free style null pointer dereference [CWE-476].

Attack Vector

The condition is triggered by USB connect and disconnect cycles on systems exposing the NCM gadget function. A local attacker or an attached USB host capable of inducing repeated bind and unbind events can provoke the dangling reference and null pointer dereference, resulting in kernel oops or panic. The vulnerability does not require network reachability and is not remotely exploitable over IP.

No verified public proof-of-concept code is available. See the upstream kernel commits in the Kernel Git Commit Fix for the technical resolution details.

Detection Methods for CVE-2026-43421

Indicators of Compromise

Kernel oops or panic messages referencing f_ncm, gether, or net_device during USB gadget disconnect events
dmesg entries showing null pointer dereferences originating from USB gadget unbind paths
Broken or dangling sysfs symbolic links under /sys/class/net/ pointing to removed gadget devices

Detection Strategies

Audit running kernel versions against the fixed commits referenced in the upstream advisory to identify systems still exposed
Monitor dmesg and journalctl -k output for repeated NCM gadget bind/unbind sequences correlated with kernel warnings
Inspect configfs interface name resolution for NCM functions to detect inconsistent state after reconnection

Monitoring Recommendations

Collect kernel ring buffer output centrally from devices that operate in USB gadget mode
Alert on stack traces containing f_ncm, gether_disconnect, or unregister_netdev during disconnect handling
Track USB device enumeration events on embedded and mobile fleets to identify abnormal bind churn

How to Mitigate CVE-2026-43421

Immediate Actions Required

Apply the upstream Linux kernel patches that introduce gether_attach_gadget() and gether_detach_gadget() helpers and the __free(detach_gadget) cleanup macro
Update to a stable kernel release that includes the fix commits from the kernel.org stable tree
Restrict physical and local USB access on systems where patching cannot be performed immediately

Patch Information

The fix uses device_move to reparent the net_device between the gadget device and /sys/devices/virtual/ across bind and unbind cycles. The bind_count field ensures device_move executes only on the first bind, preserving the network interface across USB reconnection so that DHCP servers retain their binding. The relevant commits are available in the kernel stable tree: Kernel Git Commit Changes, Kernel Git Commit Fix, Kernel Git Commit Security Update, and Kernel Git Commit Improvement.

Workarounds

Disable the NCM gadget function in configfs on systems that do not require USB networking
Avoid configurations that repeatedly bind and unbind the USB gadget while the host driver is attached
Unload the usb_f_ncm module on affected systems where the function is not required

bash

# Disable the NCM gadget function where not required
sudo rmmod usb_f_ncm

# Prevent the module from loading at boot
echo "blacklist usb_f_ncm" | sudo tee /etc/modprobe.d/blacklist-usb-f-ncm.conf