The vulnerability arises from a null pointer dereference in the Linux kernel NCM gadget driver during the gncm_bind process. When the driver attempts to access a net_device before it has been fully instantiated, the kernel may crash. This crash can lead to a denial of service, potentially disrupting system stability and availability. The flaw is an internal driver bug and does not directly grant remote code execution or data exposure.

All Linux kernel versions that contain the legacy NCM driver before the applied patch are affected. No specific CVE‑affected kernel releases are listed; the issue applies to any kernel build that compiles the NCM gadget modules without the fix. Users operating recent kernels that have not incorporated the commit addressing the null pointer dereference remain vulnerable.

The CVSS score is not provided, and the EPSS score is unavailable, so the exploitation probability is uncertain. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need to trigger gncm_bind, which occurs when the NCM gadget driver is loaded, commonly when a USB device is connected. Although the attack vector is likely local or device‑centric, the kernel crash could still lead to a denial of service. No public exploit is known, and the issue was resolved by the referenced commit.