PT-2026-39083 · Linux · Linux Kernel

Published 2026-05-08 · Updated 2026-05-15 · CVE-2026-43422

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A NULL pointer dereference occurs in the legacy NCM driver within the gncm bind() function. This issue arises because the driver attempts to access the net device before it is fully instantiated, following a change that deferred the allocation of the net device to align its lifecycle with the bind/unbind process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-43422

Affected Products

Linux Kernel

References · 12

• https://security-tracker.debian.org/tracker/CVE-2026-43422 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-43422 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43422 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-43422 · Security Note
• https://ubuntu.com/security/CVE-2026-43422 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43422 · Vendor Advisory
• https://twitter.com/hetmehtaa/status/2055151398283837677 · Twitter Post
• https://git.kernel.org/linus/fde0634ad9856b3943a2d1a8cc8de174a63ac840 · Note
• https://git.kernel.org/stable/c/b23e86a3a15803c3dcb24701285f73e65099fdf9 · Note
• https://git.kernel.org/stable/c/fde0634ad9856b3943a2d1a8cc8de174a63ac840 · Note
• https://twitter.com/CVEnew/status/2052767651840332193 · Twitter Post
• https://git.kernel.org/stable/c/be5738d19bed244ede84da45bc45395bcb1d99e0 · Note