---
id: CVE-2026-43421
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  usb: gadget: f_ncm: Fix net_device lifecycle with device_move

  The network device outlived its parent gadget device during
  disconnection, resulting in dangling sysfs li…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  usb: gadget: f_ncm: Fix net_device lifecycle with device_move

  The network device outlived its parent gadget device during
  disconnection, resulting in dangling sysfs li…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-476
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 3.11, < 6.12.78'
  - 'linux_kernel >= 6.13, < 6.18.19'
  - 'linux_kernel >= 6.19, < 6.19.9'
  - linux_kernel = 7.0
patched:
  - linux_kernel 6.19.9
published: '2026-05-08'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T02:19:33.690'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-43421'
references:
  - url: 'https://git.kernel.org/stable/c/36c41e9724c9a7a7cda37f5a4e9d94f25c8031c4'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/7c97366f5dac5255e60a317ffe3a5b18f3745547'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/85acaba2f42b557499bab3608307f17bf13beb69'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/93f116c3393a22acab96ad1bef12b2572eb80ca4'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e584cb58a2ea7ff4d3a4bc43d5ca512ed3ecb77d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ec35c1969650e7cb6c8a91020e568ed46e3551b0'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-784472.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
epss: 0.00162
epssPercentile: 0.0505
ingestedAt: '2026-10-15T03:30:12.874Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_ncm: Fix net_device lifecycle with device_move

The network device outlived its parent gadget device during
disconnection, resulting in dangling sysfs links and null pointer
dereference problems.

A prior attempt to solve this by removing SET_NETDEV_DEV entirely [1]
was reverted due to power management ordering concerns and a NO-CARRIER
regression.

A subsequent attempt to defer net_device allocation to bind [2] broke
1:1 mapping between function instance and network device, making it
impossible for configfs to report the resolved interface name. This
results in a regression where the DHCP server fails on pmOS.

Use device_move to reparent the net_device between the gadget device and
/sys/devices/virtual/ across bind/unbind cycles. This preserves the
network interface across USB reconnection, allowing the DHCP server to
retain their binding.

Introduce gether_attach_gadget()/gether_detach_gadget() helpers and use
__free(detach_gadget) macro to undo attachment on bind failure. The
bind_count ensures device_move executes only on the first bind.

[1] https://lore.kernel.org/lkml/f2a4f9847617a0929d62025748384092e5f35cce.camel@crapouillou.net/
[2] https://lore.kernel.org/linux-usb/795ea759-7eaf-4f78-81f4-01ffbf2d7961@ixit.cz/

## Affected

- `linux_kernel >= 3.11, < 6.12.78`
- `linux_kernel >= 6.13, < 6.18.19`
- `linux_kernel >= 6.19, < 6.19.9`
- `linux_kernel = 7.0`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.19.9`