CVE-2026-43422

kernel: usb: legacy: ncm: Fix NPE in gncm_bind

Loading…

Severity

Unknown

Red Hat Product Security

—

CVSS

Review impact separately from score.

Published · May 8, 2026

Updated · June 28, 2026

Description

A flaw was found in the Linux kernel's USB legacy NCM (Network Control Model) driver. This vulnerability occurs due to a NULL pointer dereference in the gncm_bind function, where the driver attempts to access a network device (net_device) before it has been fully initialized. An attacker could potentially trigger this flaw, leading to a system crash and a denial of service.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CWE-824 · Access of Uninitialized Pointer