CVE-2026-43422

In the Linux kernel, the following vulnerability has been resolved:

usb: legacy: ncm: Fix NPE in gncm_bind

Commit 56a512a9b410 ("usb: gadget: fncm: align netdevice lifecycle with bind/unbind") deferred the allocation of the netdevice. This change leads to a NULL pointer dereference in the legacy NCM driver as it attempts to access the netdevice before it's fully instantiated.

Store the provided qmult, hostaddr, and devaddr into the struct ncmopts->netopts during gncmbind(). These values will be properly applied to the netdevice when it is allocated and configured later in the binding process by the NCM function driver.