CVE-2026-43421

A flaw was found in the Linux kernel's USB gadget function for Network Control Model (NCM). During device disconnection, a network device could outlive its parent gadget device, leading to dangling system file system (sysfs) links and null pointer dereference problems. This vulnerability can result in a system crash, causing a Denial of Service (DoS).

This vulnerability is rated as Moderate severity because exploitation requires local access or specific USB peripheral configurations to trigger a system crash, without directly compromising data integrity or confidentiality. In default Red Hat Enterprise Linux installations, USB gadget mode is neither active nor configured, as enterprise systems typically act as USB hosts rather than USB peripheral devices. Consequently, risk is primarily confined to specialized deployments, such as automotive or embedded environments, that explicitly expose the Network Control Model gadget interface. An unprivileged attacker cannot exploit this condition under standard configurations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.