usb: gadget: f_ncm: Fix atomic context locking issue

MITRE NVD CVE.ORG JSON API Print: PDF PDF

Summary

CVECVE-2026-43423
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-05-08 15:16:54 UTC
Updated2026-05-12 14:10:27 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_ncm: Fix atomic context locking issue The ncm_set_alt function was holding a mutex to protect against races with configfs, which invokes the might-sleep function inside an atomic context. Remove the struct net_device pointer from the f_ncm_opts structure to eliminate the contention. The connection state is now managed by a new boolean flag to preserve the use-after-free fix from commit 6334b8e4553c ("usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport error"). BUG: sleeping function called from invalid context Call Trace: dump_stack_lvl+0x83/0xc0 dump_stack+0x14/0x16 __might_resched+0x389/0x4c0 __might_sleep+0x8e/0x100 ... __mutex_lock+0x6f/0x1740 ... ncm_set_alt+0x209/0xa40 set_config+0x6b6/0xb40 composite_setup+0x734/0x2b40 ...

Risk And Classification

EPSS: 0.000170000 probability, percentile 0.041320000 (date 2026-05-12)

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected b62076e780a2121903ecf9ffdfb89c64647cb7da e533a44fb1b337d14f772585b67328bee2e0b5e3 git Not specified
CNA Linux Linux affected 188338c1827842f898761a939669cf345bdf07e2 e95120b4b95ef1c16d8e94e201ae89f5e59e2612 git Not specified
CNA Linux Linux affected 56a512a9b4107079f68701e7d55da8507eb963d9 0d6c8144ca4d93253de952a5ea0028c19ed7ab68 git Not specified
CNA Linux Linux affected 6.18.17 6.18.19 semver Not specified
CNA Linux Linux affected 6.19.7 6.19.9 semver Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/0d6c8144ca4d93253de952a5ea0028c19ed7ab68 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/e95120b4b95ef1c16d8e94e201ae89f5e59e2612 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/e533a44fb1b337d14f772585b67328bee2e0b5e3 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis
© CVE.report 2026 |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report