# CVE-2026-23320: usb: gadget: f_ncm: align net_device lifecycle with bind/unbind

CVE-2026-23320 is fixed in linux on 1 platform by DEBIAN-CVE-2026-23320 (version 6.19.8-1), released March 25, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-23320
- Priority: Routine
- CVSS: 5.5 (Moderate)
- EPSS: n/a
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Mar 25, 2026
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23320

## Description

In the Linux kernel, the following vulnerability has been resolved:  usb: gadget: f_ncm: align net_device lifecycle with bind/unbind  Currently, the net_device is allocated in ncm_alloc_inst() and freed in ncm_free_inst(). This ties the network interface's lifetime to the configuration instance rather than the USB connection (bind/unbind).  This decoupling causes issues when the USB gadget is disconnected where the underlying gadget device is removed. The net_device can outlive its parent, leading to dangling sysfs links and NULL pointer dereferences when accessing the freed gadget device.  Problem 1: NULL pointer dereference on disconnect  Unable to handle kernel NULL pointer dereference at virtual address  0000000000000000  Call trace:    __pi_strlen+0x14/0x150    rtnl_fill_ifinfo+0x6b4/0x708    rtmsg_ifinfo_build_skb+0xd8/0x13c    rtmsg_ifinfo+0x50/0xa0    __dev_notify_flags+0x4c/0x1f0    dev_change_flags+0x54/0x70    do_setlink+0x390/0xebc    rtnl_newlink+0x7d0/0xac8    rtnetlink_rcv_msg+0x27c/0x410    netlink_rcv_skb+0x134/0x150    rtnetlink_rcv+0x18/0x28    netlink_unicast+0x254/0x3f0    netlink_sendmsg+0x2e0/0x3d4  Problem 2: Dangling sysfs symlinks  console:/ # ls -l /sys/class/net/ncm0  lrwxrwxrwx ... /sys/class/net/ncm0 ->  /sys/devices/platform/.../gadget.0/net/ncm0  console:/ # ls -l /sys/devices/platform/.../gadget.0/net/ncm0  ls: .../gadget.0/net/ncm0: No such file or directory  Move the net_device allocation to ncm_bind() and deallocation to ncm_unbind(). This ensures the network interface exists only when the gadget function is actually bound to a configuration.  To support pre-bind configuration (e.g., setting interface name or MAC address via configfs), cache user-provided options in f_ncm_opts using the gether_opts structure. Apply these cached settings to the net_device upon creation in ncm_bind().  Preserve the use-after-free fix from commit 6334b8e4553c ("usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport error"). Check opts->net in ncm_set_alt() and ncm_disable() to ensure gether_disconnect() runs only if a connection was established.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 14 | 6.19.8-1 | [DEBIAN-CVE-2026-23320](https://patchblox.com/security/data/fix/linux/debian-cve-2026-23320.md) | Mar 25, 2026 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.