The vulnerability in the Linux kernel's usb gadget function f_ncm arises from improper error handling in the bind path. After a bind/unbind cycle, the ncm->notify_req remains stale. If a subsequent bind operation fails, the error handling code attempts to free this stale request, resulting in a NULL pointer dereference when accessing ep->ops->free_request. This leads to a kernel crash. The fix refactors the bind path to use the __free() automatic cleanup mechanism to prevent the stale pointer dereference.

Successful exploitation causes a kernel NULL pointer dereference, leading to a denial of service via kernel crash. The impact includes complete loss of confidentiality, integrity, and availability as indicated by the CVSS vector (C:H/I:H/A:H). There is no indication of remote exploitability without local access, as the attack vector is local (AV:L).

A fix has been implemented in the Linux kernel to refactor the bind path to use the __free() automatic cleanup mechanism, preventing the NULL pointer dereference. Users should apply the official kernel updates that include this fix. Patch status is not explicitly provided here; check the Linux kernel vendor advisory or distribution security updates for the official patch and remediation guidance.