CVE-2026-43423
📛 CVE Title
usb: gadget: f_ncm: Fix atomic context locking issue
Description
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_ncm: Fix atomic context locking issue The ncm_set_alt function was holding a mutex to protect against races with configfs, which invokes the might-sleep function inside an atomic context. Remove the struct net_device pointer from the f_ncm_opts structure to eliminate the contention. The connection state is now managed by a new boolean flag to preserve the use-after-free fix from commit 6334b8e4553c ("usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport error"). BUG: sleeping function called from invalid context Call Trace: dump_stack_lvl+0x83/0xc0 dump_stack+0x14/0x16 __might_resched+0x389/0x4c0 __might_sleep+0x8e/0x100 ... __mutex_lock+0x6f/0x1740 ... ncm_set_alt+0x209/0xa40 set_config+0x6b6/0xb40 composite_setup+0x734/0x2b40 ...
Overview
- State
- PUBLISHED
- Assigner (CNA)
- Linux
- CVSS severity
- high
- CVSS score
- 7.1 / 10
- CVSS vector
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H- Effective score
- 7.1 / 10 HIGH source: CNA overview
- CWE(s)
- —
- Reserved
- 2026-05-01
- Published
- 2026-05-08 16:21 UTC
- Last updated
- 2026-05-12 00:24 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/43xxx/CVE-2026-43423.json
- Linked Threat
- CVE-2026-43423 — CVE-2026-43423
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2026-05-08 15:16:54 UTC
- NVD last modified
- 2026-05-12 14:10:27 UTC
- EPSS score
- 0.0002 (probability of exploitation in next 30 days)
- EPSS percentile
- 6.46% vs all CVEs — higher = more likely to be exploited, as of 2026-05-24
NVD / KEV / EPSS data refreshed 2026-05-25 09:01 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-28729 - Assigner
- Linux
- Published
- May 8, 2026, 2:21:57 PM
- Updated
- May 11, 2026, 10:24:18 PM
- EUVD base score
- 0.0 / 10
- EUVD-reported EPSS
- 0.0100
- Vendors
- Linux
- Products
-
Linux (188338c1827842f898761a939669cf345bdf07e2 <e95120b4b95ef1c16d8e94e201ae89f5e59e2612)Linux (56a512a9b4107079f68701e7d55da8507eb963d9 <0d6c8144ca4d93253de952a5ea0028c19ed7ab68)Linux (b62076e780a2121903ecf9ffdfb89c64647cb7da <e533a44fb1b337d14f772585b67328bee2e0b5e3)Linux (6.18.17 <6.18.19)Linux (6.19.7 <6.19.9)
ENISA description: In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_ncm: Fix atomic context locking issue The ncm_set_alt function was holding a mutex to protect against races with configfs, which invokes the might-sleep function inside an atomic context. Remove the struct net_device pointer from the f_ncm_opts structure to eliminate the contention. The connection state is now managed by a new boolean flag to preserve the use-after-free fix from commit 6334b8e4553c ("usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport error"). BUG: sleeping function called from invalid context Call Trace: dump_stack_lvl+0x83/0xc0 dump_stack+0x14/0x16 __might_resched+0x389/0x4c0 __might_sleep+0x8e/0x100 ... __mutex_lock+0x6f/0x1740 ... ncm_set_alt+0x209/0xa40 set_config+0x6b6/0xb40 composite_setup+0x734/0x2b40 ...
Affected products (2)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| Linux | Linux |
b62076e780a2121903ecf9ffdfb89c64647cb7da (affected),
188338c1827842f898761a939669cf345bdf07e2 (affected),
56a512a9b4107079f68701e7d55da8507eb963d9 (affected)
|
— |
| Linux | Linux |
6.18.17 (affected),
6.19.7 (affected)
|
— |
Vendor references (3)
References embedded in the original CVE record by the assigning CNA.
MITRE references (3) cveawg.mitre.org
Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.
Web references (3)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
- https://nvd.nist.gov/vuln/detail/CVE-2026-43423 tenable:nvd.nist.gov
- https://www.cve.org/CVERecord?id=CVE-2026-43423 tenable:www.cve.org
- https://www.first.org/epss/ tenable:www.first.org
NVD-tagged references (3)
Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.
- https://git.kernel.org/stable/c/0d6c8144ca4d93253de952a5ea0028c19ed7ab68 416baaa9-dc9f-4396-8d5f-8c081fb06d67
- https://git.kernel.org/stable/c/e533a44fb1b337d14f772585b67328bee2e0b5e3 416baaa9-dc9f-4396-8d5f-8c081fb06d67
- https://git.kernel.org/stable/c/e95120b4b95ef1c16d8e94e201ae89f5e59e2612 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Remediations (19)
Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.
-
web:access.redhat.com
The mitigation methods below address both vulnerabilities that affect Red Hat products — CVE - 2026 -43284 (IPsec ESP) and CVE - 2026 -46300 (XFRM ESP-in-TCP). CVE - 2026 -43500 (rxrpc) does not affect Red Hat products and requires no mitigation .
2026-05-23 21:04 UTC -
web:blog.qualys.com
With Qualys Policy Audit's out-of-the-box mitigation or Compensatory Controls, which reduce the risk of a vulnerability being exploited because the remediation ( fix / patch ) cannot be done immediately, these security controls are not recommended by any industry standards, such as CIS and DISA-STIG.
2026-05-23 21:04 UTC -
web:cheatsheetseries.owasp.org
Virtual Patching Cheat Sheet Introduction The goal with this cheat Sheet is to present a concise virtual patching framework that organizations can follow to maximize the timely implementation of mitigation protections. Definition: Virtual Patching A security policy enforcement layer which prevents and reports the exploitation attempt of a known vulnerability. The virtual patch works when the ...
2026-05-23 21:04 UTC -
web:heimdalsecurity.com
Explore six essential patch management best practices for 2026 to keep your systems secure, up to date, and protected from vulnerabilities.
2026-05-23 21:04 UTC -
web:portal.msrc.microsoft.com
The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.
2026-05-23 21:04 UTC -
web:www.bleepingcomputer.com
SAP has released the May 2026 security updates addressing 15 vulnerabilities across multiple products, including two critical flaws in the Commerce Cloud enterprise-grade e-commerce platform and ...
2026-05-23 21:04 UTC -
web:www.bugcrowd.com
Vulnerability mitigation is typically considered a temporary or interim solution. While mitigation measures can reduce the immediate risk associated with vulnerabilities, they may not provide a permanent fix . Organizations should aim to prioritize and plan for complete vulnerability remediation whenever feasible and allocate resources accordingly.
2026-05-23 21:04 UTC -
web:www.cisa.gov
If vulnerabilities cannot be remediated within the recommended timeframes, develop a remediation plan for action and coordination across the organization. The remediation plan should include: Vulnerability remediation constraints Interim mitigation actions to overcome constraints Final actions required to remediate vulnerability
2026-05-23 21:04 UTC -
web:www.oracle.com
This Critical Patch Update contains 481 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at April 2026 Critical Patch Update: Executive Summary and Analysis.
2026-05-23 21:04 UTC -
web:www.secure.com
Learn the difference between vulnerability remediation and mitigation , and how a risk-based strategy can strengthen your security posture.
2026-05-23 21:04 UTC -
web:blog.qualys.com
Oracle released its second quarterly edition of this year's Critical Patch Update. The update received patches for 481 security vulnerabilities.
2026-05-26 02:48 UTC -
web:blogs.oracle.com
For more information about the Critical Patch Update program, see the security vulnerability remediation practices page located on the Oracle Trust Center.
2026-05-26 02:48 UTC -
web:blog.talosintelligence.com
Microsoft has released its monthly security update for April 2026 , which includes 165 vulnerabilities affecting a wide range of products, including eight Microsoft marked as "critical." CVE - 2026 -23666 is a critical Denial of Service (DoS) vulnerability that affects the .NET framework. Successful exploitation could allow the attacker to deny service over the network. CVE - 2026 -32157 is a ...
2026-05-26 02:48 UTC -
web:support.microsoft.com
How to obtain or download the latest cumulative update package for Linux To update SQL Server 2022 on Linux to the latest CU, you must first have the Cumulative Update repository configured. Then, update your SQL Server packages by using the appropriate platform-specific update command. For installation instructions and direct links to the CU package downloads, see the SQL Server 2022 Release ...
2026-05-26 02:48 UTC -
web:support.servicenow.com
Overview The advisories below document publicly disclosed Common Vulnerabilities and Exposures ( CVEs ) in the Now Platform by ServiceNow. Because ServiceNow uses various methods to communicate vulnerability information, patches, and other fixes, customers should review family, security patch , and hotfix release notes, which are available at https://docs.servicenow.com, for a complete list of ...
2026-05-26 02:48 UTC -
web:www.crowdstrike.com
Microsoft's April 2026 Patch Tuesday addresses 164 CVEs , featuring 8 Critical vulnerabilities, one exploited zero-day, and one disclosed zero-day.
2026-05-26 02:48 UTC -
web:www.ivanti.com
April Patch Tuesday is the second-largest Patch Tuesday on record behind the October 2025 Patch Tuesday which resolved 175 CVEs . The lineup includes one zero-day exploit ( CVE - 2026 -3220) and one public disclosure ( CVE - 2026 -33825) and breaks down into 8 Critical, 156 Important, 3 Moderate and 1 Low severity.
2026-05-26 02:48 UTC -
web:www.securityweek.com
Oracle on Tuesday announced the release of 481 new security patches as part of its April 2026 Critical Patch Update (CPU). Across the 28 product families that received security updates, more than 300 patches address vulnerabilities that are remotely exploitable without authentication.
2026-05-26 02:48 UTC -
web:zecurit.com
Get the complete breakdown of Microsoft's May 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .
2026-05-26 02:48 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2026-43423.json.
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/f_ncm.c",
"drivers/usb/gadget/function/u_ether_configfs.h",
"drivers/usb/gadget/function/u_ncm.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e533a44fb1b337d14f772585b67328bee2e0b5e3",
"status": "affected",
"version": "b62076e780a2121903ecf9ffdfb89c64647cb7da",
"versionType": "git"
},
{
"lessThan": "e95120b4b95ef1c16d8e94e201ae89f5e59e2612",
"status": "affected",
"version": "188338c1827842f898761a939669cf345bdf07e2",
"versionType": "git"
},
{
"lessThan": "0d6c8144ca4d93253de952a5ea0028c19ed7ab68",
"status": "affected",
"version": "56a512a9b4107079f68701e7d55da8507eb963d9",
"versionType": "git"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/f_ncm.c",
"drivers/usb/gadget/function/u_ether_configfs.h",
"drivers/usb/gadget/function/u_ncm.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6.18.19",
"status": "affected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThan": "6.19.9",
"status": "affected",
"version": "6.19.7",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "6.18.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "6.19.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_ncm: Fix atomic context locking issue\n\nThe ncm_set_alt function was holding a mutex to protect against races\nwith configfs, which invokes the might-sleep function inside an atomic\ncontext.\n\nRemove the struct net_device pointer from the f_ncm_opts structure to\neliminate the contention. The connection state is now managed by a new\nboolean flag to preserve the use-after-free fix from\ncommit 6334b8e4553c (\"usb: gadget: f_ncm: Fix UAF ncm object at re-bind\nafter usb ep transport error\").\n\nBUG: sleeping function called from invalid context\nCall Trace:\n dump_stack_lvl+0x83/0xc0\n dump_stack+0x14/0x16\n __might_resched+0x389/0x4c0\n __might_sleep+0x8e/0x100\n ...\n __mutex_lock+0x6f/0x1740\n ...\n ncm_set_alt+0x209/0xa40\n set_config+0x6b6/0xb40\n composite_setup+0x734/0x2b40\n ..."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:24:18.117Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e533a44fb1b337d14f772585b67328bee2e0b5e3"
},
{
"url": "https://git.kernel.org/stable/c/e95120b4b95ef1c16d8e94e201ae89f5e59e2612"
},
{
"url": "https://git.kernel.org/stable/c/0d6c8144ca4d93253de952a5ea0028c19ed7ab68"
}
],
"title": "usb: gadget: f_ncm: Fix atomic context locking issue",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43423",
"datePublished": "2026-05-08T14:21:57.683Z",
"dateReserved": "2026-05-01T14:12:56.008Z",
"dateUpdated": "2026-05-11T22:24:18.117Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}