PT-2026-39082 · Linux · Linux Kernel

Published 2026-05-08 · Updated 2026-05-08 · CVE-2026-43421

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw in the usb gadget f ncm component allows a network device to outlive its parent gadget device during disconnection. This leads to dangling sysfs links and null pointer dereference problems. The issue is addressed by using device move to reparent the net device between the gadget device and /sys/devices/virtual/ during bind and unbind cycles, which maintains the network interface across USB reconnections.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-43421

Affected Products

Linux Kernel

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-43421 · Security Note
• https://git.kernel.org/stable/c/ec35c1969650e7cb6c8a91020e568ed46e3551b0 · Note
• https://git.kernel.org/stable/c/85acaba2f42b557499bab3608307f17bf13beb69 · Note
• https://git.kernel.org/stable/c/e584cb58a2ea7ff4d3a4bc43d5ca512ed3ecb77d · Note
• https://twitter.com/CVEnew/status/2052767653274755294 · Twitter Post
• https://git.kernel.org/stable/c/93f116c3393a22acab96ad1bef12b2572eb80ca4 · Note