{
  "cveId": "CVE-2026-23320",
  "url": "https://patchblox.com/security/cve/CVE-2026-23320",
  "summary": "CVE-2026-23320 is fixed in linux on 1 platform by DEBIAN-CVE-2026-23320 (version 6.19.8-1), released March 25, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "usb: gadget: f_ncm: align net_device lifecycle with bind/unbind",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  usb: gadget: f_ncm: align net_device lifecycle with bind/unbind  Currently, the net_device is allocated in ncm_alloc_inst() and freed in ncm_free_inst(). This ties the network interface\u0027s lifetime to the configuration instance rather than the USB connection (bind/unbind).  This decoupling causes issues when the USB gadget is disconnected where the underlying gadget device is removed. The net_device can outlive its parent, leading to dangling sysfs links and NULL pointer dereferences when accessing the freed gadget device.  Problem 1: NULL pointer dereference on disconnect  Unable to handle kernel NULL pointer dereference at virtual address  0000000000000000  Call trace:    __pi_strlen\u002B0x14/0x150    rtnl_fill_ifinfo\u002B0x6b4/0x708    rtmsg_ifinfo_build_skb\u002B0xd8/0x13c    rtmsg_ifinfo\u002B0x50/0xa0    __dev_notify_flags\u002B0x4c/0x1f0    dev_change_flags\u002B0x54/0x70    do_setlink\u002B0x390/0xebc    rtnl_newlink\u002B0x7d0/0xac8    rtnetlink_rcv_msg\u002B0x27c/0x410    netlink_rcv_skb\u002B0x134/0x150    rtnetlink_rcv\u002B0x18/0x28    netlink_unicast\u002B0x254/0x3f0    netlink_sendmsg\u002B0x2e0/0x3d4  Problem 2: Dangling sysfs symlinks  console:/ # ls -l /sys/class/net/ncm0  lrwxrwxrwx ... /sys/class/net/ncm0 -\u003E  /sys/devices/platform/.../gadget.0/net/ncm0  console:/ # ls -l /sys/devices/platform/.../gadget.0/net/ncm0  ls: .../gadget.0/net/ncm0: No such file or directory  Move the net_device allocation to ncm_bind() and deallocation to ncm_unbind(). This ensures the network interface exists only when the gadget function is actually bound to a configuration.  To support pre-bind configuration (e.g., setting interface name or MAC address via configfs), cache user-provided options in f_ncm_opts using the gether_opts structure. Apply these cached settings to the net_device upon creation in ncm_bind().  Preserve the use-after-free fix from commit 6334b8e4553c (\u0022usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport error\u0022). Check opts-\u003Enet in ncm_set_alt() and ncm_disable() to ensure gether_disconnect() runs only if a connection was established.",
  "published": "2026-03-25T11:16:28Z",
  "severity": "Moderate",
  "cvss": 5.5,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23320",
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.19.8-1",
      "fix": "DEBIAN-CVE-2026-23320",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-23320",
      "released": "2026-03-25T11:16:28Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}