CVE-2026-43422 Overview
CVE-2026-43422 is a null pointer dereference vulnerability in the Linux kernel's legacy Network Control Model (NCM) USB gadget driver. The flaw resides in the gncm_bind() function within the USB legacy NCM subsystem. A prior kernel commit (56a512a9b410, "usb: gadget: f_ncm: align net_device lifecycle with bind/unbind") deferred allocation of the net_device structure. The legacy NCM driver was not updated to reflect this change and attempts to access the net_device before it is fully instantiated, triggering a null pointer dereference [CWE-476].
Critical Impact
Local triggering of the dereference can cause a kernel null pointer dereference, leading to a denial of service on affected Linux kernel builds that include the legacy NCM gadget driver.
Affected Products
- Linux kernel builds containing the legacy USB NCM gadget driver after commit 56a512a9b410
- Distributions packaging the affected stable kernel branches
- Embedded and gadget-mode Linux systems exposing the legacy NCM interface
Discovery Timeline
- 2026-05-08 - CVE-2026-43422 published to NVD
- 2026-05-12 - Last updated in NVD database
Technical Details for CVE-2026-43422
Vulnerability Analysis
The vulnerability stems from a lifecycle mismatch between the NCM function driver and the legacy NCM gadget driver. Commit 56a512a9b410 modified the NCM function driver to defer net_device allocation so that the device lifecycle aligns with USB bind and unbind operations. The legacy NCM driver, however, continued to assume the net_device exists during gncm_bind(). When gncm_bind() runs, it dereferences a structure pointer that has not yet been populated, producing a kernel oops.
The upstream fix stores the qmult, host_addr, and dev_addr configuration parameters into struct ncm_opts->net_opts during gncm_bind(). The NCM function driver later applies these values when it allocates and configures the net_device during the binding process. This restores the expected initialization order without reverting the lifecycle change.
Root Cause
The root cause is an unsynchronized API contract change between the NCM function driver and its legacy consumer. The legacy driver accessed net_device fields directly during bind, while the function driver no longer guaranteed that the structure existed at that point. The result is a classic null pointer dereference triggered by normal initialization paths.
Attack Vector
Triggering the dereference requires local interaction with the USB gadget subsystem on a system that loads the legacy NCM driver. An unprivileged user cannot reach this code path on most production systems, but administrators or local users with control over gadget configuration can induce a kernel crash. The primary impact is denial of service through a kernel panic or oops.
No verified public exploit code is available. The vulnerability is described in prose only in the upstream commit messages. See the kernel commit log for the patch source.
Detection Methods for CVE-2026-43422
Indicators of Compromise
- Kernel oops or panic messages referencing gncm_bind or f_ncm in dmesg and journalctl output
- Unexpected USB gadget binding failures on systems configured with the legacy NCM driver
- Repeated kernel stack traces involving NULL dereference in the USB legacy gadget code path
Detection Strategies
- Inventory running kernels and compare versions against the patched stable releases referenced in the upstream commits
- Audit which systems load the g_ncm legacy module via lsmod and configuration management baselines
- Correlate kernel crash telemetry with USB gadget initialization events to identify exposed hosts
Monitoring Recommendations
- Forward kernel logs to a centralized log platform and alert on BUG: kernel NULL pointer dereference entries
- Track module load events for g_ncm and other legacy USB gadget drivers across the fleet
- Monitor for unexpected reboots on embedded Linux devices that expose USB gadget interfaces
How to Mitigate CVE-2026-43422
Immediate Actions Required
- Apply the upstream kernel patches referenced in the stable tree commits as soon as vendor builds become available
- Unload the legacy g_ncm module on systems where it is not required for device function
- Restrict local access to USB gadget configuration interfaces under /sys/kernel/config/usb_gadget/
Patch Information
The fix is available in the upstream Linux stable tree across three commits: b23e86a3a158, be5738d19bed, and fde0634ad985. The patches store qmult, host_addr, and dev_addr into struct ncm_opts->net_opts during gncm_bind() so that the NCM function driver can apply them when allocating the net_device.
Workarounds
- Blacklist the legacy g_ncm kernel module on systems that do not require USB NCM gadget functionality
- Switch from the legacy NCM gadget driver to the modern configfs-based USB gadget configuration where supported
- Limit physical and administrative access to systems running affected kernels until patches are deployed
# Configuration example: blacklist the legacy NCM gadget module
echo "blacklist g_ncm" | sudo tee /etc/modprobe.d/blacklist-g_ncm.conf
sudo rmmod g_ncm 2>/dev/null || true
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
