Executive brief
A vulnerability in the Linux kernel's USB gadget driver could allow a local user to cause a system crash. The issue occurs when the system incorrectly attempts to perform a 'sleep' operation while in a restricted processing state that does not allow it. This can lead to a kernel panic or system instability, impacting the availability of devices using this specific USB networking protocol.
Technical details
A locking issue exists in the f_ncm USB gadget function of the Linux kernel. The ncm_set_alt function incorrectly holds a mutex to protect against races with configfs; however, this function is invoked within an atomic context where sleeping is prohibited. This violation of atomic context (calling a 'might_sleep' function like mutex_lock) can trigger a kernel BUG and subsequent system hang or panic. The fix involves removing the net_device pointer from the f_ncm_opts structure and using a boolean flag to manage connection state, thereby eliminating the need for the problematic mutex in that path. Patches have been released for various stable kernel branches.
Affected products
- Linux Linux Kernel 6.18.17 to 6.18.19, 6.19.7 to 6.19.9, 7.0-rc1 to 7.0-rc3
Timeline
- 2026-05-08: disclosed: Initial publication of the CVE
- 2026-02-23: patched: Fix committed to stable kernel tree