CVE-2026-43423

✕ Withdrawn — historical dataMEDIUMNVD 5.5
5.5CVSS

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_ncm: Fix atomic context locking issue

The ncm_set_alt function was holding a mutex to protect against races with configfs, which invokes the might-sleep function inside an atomic context.

Remove the struct net_device pointer from the f_ncm_opts structure to eliminate the contention. The connection state is now managed by a new boolean flag to preserve the use-after-free fix from commit 6334b8e4553c ("usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport error").

BUG: sleeping function called from invalid context Call Trace: dump_stack_lvl+0x83/0xc0 dump_stack+0x14/0x16 __might_resched+0x389/0x4c0 __might_sleep+0x8e/0x100 ... __mutex_lock+0x6f/0x1740 ... ncm_set_alt+0x209/0xa40 set_config+0x6b6/0xb40 composite_setup+0x734/0x2b40 ...

CVSS v3
5.5
EchelonGraph score
Not yet assessedThis CVE record was withdrawn by its numbering authority, so there is no vulnerability to rate.
EPSS PROB
—
EPSS %ILE
—
KEV
—Not applicable: this CVE ID was withdrawn

Published

May 8, 2026

Last Modified

May 22, 2026

References (3)

Frequently asked(4)

What is CVE-2026-43423?
CVE-2026-43423 is a rejected CVE ID: its record was withdrawn on June 17, 2026 and no longer describes a vulnerability. Reason given: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
When was the CVE record for CVE-2026-43423 published?
The CVE record for CVE-2026-43423 was published on May 8, 2026. EchelonGraph's copy of the record carries a last-modified date of May 22, 2026; the record at its source may have been updated since.
What is the CVSS score of CVE-2026-43423?
CVE-2026-43423 has a CVSS v3 base score of 5.5 (NVD).
How do I remediate CVE-2026-43423?
There is nothing to remediate under CVE-2026-43423: it is a rejected (withdrawn) CVE ID and no longer describes a vulnerability.