CVE-2026-43423: usb: gadget: f_ncm: Fix atomic context locking issue
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Apply the source change that removes the struct net_device pointer from f_ncm_opts and instead manage the connection state using a new boolean flag so ncm_set_alt no longer holds a mutex that can invoke might_sleep in an atomic context.
Linux kernel (usb: gadget: f_ncm) f_ncm_opts struct composition / connection state representation = remove struct net_device pointer; add boolean flag to track connection state - Operational
Rebuild and deploy the Linux kernel containing the above source change (install the patched kernel image and reboot affected systems). Ensure the patched kernel is running on affected hosts.
Event History
Frequently Asked Questions
Is this CVE still a valid vulnerability identifier for triage or remediation tracking?
No action should be taken based on this CVE as an active vulnerability record: its CVE Numbering Authority rejected or withdrew the ID. The record was rejected on 2026-05-08 and again on 2026-06-17.
What component is associated with the rejected record?
The listed scope is the Linux kernel USB gadget f_ncm component. The provided data does not identify affected versions, configurations, or exposure conditions.