CVE-2026-23320: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23320 is a memory lifecycle bug in the Linux kernel's USB NCM (Network Control Model) gadget driver (f_ncm). The vulnerability arises because the net_device is allocated during configuration instance creation and freed during instance destruction, rather than being tied to the USB connection bind/unbind cycle. This CVE has been rejected/withdrawn by its CVE Numbering Authority (CVE.org, Red Hat Advisory). Prior to rejection, it carried an estimated CVSS v3.1 base score of 5.5 (Medium), with a local attack vector and high availability impact (Red Hat Advisory).

The root cause is classified as CWE-772 (Missing Release of Resource after Effective Lifetime). In the affected Linux kernel USB NCM gadget driver, net_device is allocated in ncm_alloc_inst() and freed in ncm_free_inst(), decoupling the network interface lifetime from the USB gadget bind/unbind cycle. When the USB gadget is disconnected, the net_device can outlive its parent gadget device, causing two distinct issues: (1) NULL pointer dereferences when netlink operations (e.g., rtnetlink queries or interface flag changes via do_setlink) attempt to access the freed gadget device through string processing functions like __pi_strlen; and (2) dangling sysfs symlinks under /sys/class/net/ that reference non-existent device paths (Red Hat Bugzilla). Exploitation requires local access to a system with USB NCM gadget functionality enabled.

Successful exploitation can cause kernel NULL pointer dereference crashes, resulting in a denial of service (system crash or kernel panic) on affected systems. The availability impact is high, while confidentiality and integrity are not directly affected. Additionally, dangling sysfs symlinks create file system inconsistencies that may persist until the system is rebooted. Affected systems are typically embedded devices, Android devices, or Linux systems explicitly configured with USB gadget support (Red Hat Bugzilla, Red Hat Advisory).

A patch is available that realigns net_device allocation to ncm_bind() and deallocation to ncm_unbind(), ensuring the network interface only exists when the gadget function is bound to a configuration. The fix also caches user-provided configuration options in f_ncm_opts to support pre-bind configuration. Systems without USB NCM gadget driver enabled are not affected. Administrators should apply the upstream kernel patch and restrict local access to network configuration operations where possible (Red Hat Bugzilla, Red Hat Advisory). Note that this CVE has been officially rejected/withdrawn, so tracking should be updated accordingly.

The CVE was rejected by the Linux kernel CVE team via the linux-cve-announce mailing list on April 3, 2026, indicating the issue was determined not to meet CVE criteria or was a duplicate (linux-cve-announce). Red Hat tracked the issue via Bugzilla and updated its advisory to reflect the rejection status. No significant broader community or media discussion has been observed given the CVE's rejection and low severity.