The Linux kernel’s f_ncm USB gadget driver creates a network device that is freed when the gadget disconnects, but its lifecycle is tied to the configuration instance rather than the bind/unbind process. This misalignment allows the net_device to outlive its gadget, resulting in dangling sysfs links and NULL pointer dereferences that cause the kernel to crash. The kernel panic effectively brings the system down, resulting in denial of service.

All Linux kernel builds that ship the f_ncm driver without the commit that moves the net_device allocation into ncm_bind() and its deallocation into ncm_unbind() are affected. If you are running a distribution kernel that has not incorporated this change, your system is vulnerable. Custom kernels can be checked for the specific commit or the absence of the fix.

The CVSS score of 7.0 indicates a medium‑to‑high severity. The EPSS score is below 1% and the flaw is not in the CISA KEV list, suggesting a low likelihood of widespread exploitation. The likely attack vector requires a local or privileged user to orchestrate a USB gadget disconnect while the driver is active, which would trigger the kernel crash. Since the vulnerability is tied to kernel internals, exploitation requires sufficient privileges to interact with the USB gadget interface.