Executive brief
A vulnerability in the Linux kernel's USB networking component could allow a local user to cause a system crash. The issue occurs when a USB network device is disconnected, leading to a memory error known as a null pointer dereference. This primarily impacts system availability and could disrupt network services relying on USB gadget interfaces.
Technical details
A null pointer dereference vulnerability exists in the Linux kernel's USB gadget framework, specifically within the f_ncm (Network Control Model) function driver. The root cause is a lifecycle mismatch where the 'net_device' structure outlives its parent 'gadget' device during a USB disconnection event, leading to dangling sysfs links and invalid memory access. An attacker with local access could trigger this condition by cycling USB gadget bindings, resulting in a kernel oops or system crash. The fix introduces 'device_move' to properly reparent the network device between the gadget and virtual device trees across bind/unbind cycles, ensuring stable memory references. Patches are available for multiple stable kernel branches including 6.12.y, 6.18.y, and 6.19.y.
Affected products
- Linux Linux kernel 3.11 to 6.12.78, 6.13 to 6.18.19, 6.19 to 6.19.9, 7.0-rc1 to 7.0-rc3
Timeline
- 2026-05-08: disclosed
- 2026-05-08: advisory
- 2026-03-19: patched: Initial patch in stable tree branch 85acaba2f42b557499bab3608307f17bf13beb69