CVE-2026-43422

Description

A flaw was found in the Linux kernel's USB legacy NCM (Network Control Model) driver. This vulnerability occurs due to a NULL pointer dereference in the gncm_bind function, where the driver attempts to access a network device (net_device) before it has been fully initialized. An attacker could potentially trigger this flaw, leading to a system crash and a denial of service.

Understanding the Weakness (CWE)

CWE-824

Confidentiality

Technical Impact: Read Memory

If the uninitialized pointer is used in a read operation, an attacker might be able to read sensitive portions of memory.

Availability

Technical Impact: DoS: Crash, Exit, or Restart

If the uninitialized pointer references a memory location that is not accessible to the product, or points to a location that is "malformed" (such as NULL) or larger than expected by a read or write operation, then a crash may occur.

Integrity,Confidentiality,Availability

Technical Impact: Execute Unauthorized Code or Commands

If the uninitialized pointer is used in a function call, or points to unexpected data in a write operation, then code execution may be possible.

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.