Executive brief
A vulnerability in the Linux kernel's USB networking driver could allow a local user to crash the system. The issue occurs when the system attempts to access a network device before it has been fully set up. This results in a system crash (kernel panic), potentially disrupting operations or causing a denial of service.
Technical details
A NULL pointer dereference exists in the Linux kernel's legacy USB NCM driver (drivers/usb/gadget/legacy/ncm.c) within the gncm_bind function. The vulnerability was introduced by a change that deferred the allocation of the net_device structure, causing the driver to attempt to access uninitialized memory during the binding process. A local attacker with the ability to trigger USB gadget binding could exploit this to cause a kernel panic (Denial of Service). The fix involves storing configuration options (qmult, host_addr, dev_addr) in the ncm_opts structure so they can be applied safely after the net_device is instantiated. Patches have been released for multiple stable kernel branches.
Affected products
- Linux Linux Kernel 6.18.17 to 6.18.19, 6.19.7 to 6.19.9, 7.0-rc1 to 7.0-rc3
Timeline
- 2026-02-21: patched: Initial patch authored
- 2026-05-08: disclosed: CVE published
- 2026-05-22: advisory: NVD enrichment and CVSS assessment provided