CVE-2026-43422: usb: legacy: ncm: Fix NPE in gncm_bind
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 56a512a9b410 - Configuration
Modify gncm_bind() to store the provided qmult, host_addr, and dev_addr into ncm_opts->net_opts so these values are applied later when the net_device is allocated and configured by the NCM function driver.
Linux kernel (usb legacy NCM driver, gncm_bind) store qmult, host_addr, dev_addr into ncm_opts->net_opts = store provided qmult, host_addr, and dev_addr into struct ncm_opts->net_opts during gncm_bind()
Event History
Frequently Asked Questions
Should this record be tracked as an active vulnerability?
This CVE identifier has been rejected or withdrawn by its CVE Numbering Authority. It should not be treated as an active vulnerability record for the Linux kernel.
What technical impact and scope are confirmed by the available record?
The supplied data identifies the issue as a null pointer dereference associated with gncm_bind in the Linux kernel's legacy USB NCM component. No affected versions, configurations, exploit prerequisites, or mitigations are provided.