CVE-2026-23447 Details
Description
In the Linux kernel, the following vulnerability has been resolved: net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check The same bounds-check bug fixed for NDP16 in the previous patch also exists in cdc_ncm_rx_verify_ndp32(). The DPE array size is validated against the total skb length without accounting for ndpoffset, allowing out-of-bounds reads when the NDP32 is placed near the end of the NTB. Add ndpoffset to the nframes bounds check and use struct_size_t() to express the NDP-plus-DPE-array size more clearly. Compile-tested only.
A bounds-check vulnerability has been identified in the Linux kernel's CDC NCM USB driver, specifically in the function that handles the 32-bit version of the NCM Transfer Block. The issue arises because the size of the Data Payload Extension (DPE) array is validated against the total length of the socket buffer (skb) without considering the NDP offset. This oversight can lead to out-of-bounds reads, particularly when the NDP32 is positioned near the end of the NTB.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/125f932a76a97904ef8a555f1dd53e5d0e288c54 | kernel.org | Patch |
| https://git.kernel.org/stable/c/77914255155e68a20aa41175edeecf8121dac391 | kernel.org | Patch |
| https://git.kernel.org/stable/c/a5bd5a2710310c965ea4153cba4210988a3454e2 | kernel.org | Patch |
| https://git.kernel.org/stable/c/af0d1613d6751489dbf9f69aac1123f0b1e566e5 | kernel.org | Patch |
| https://git.kernel.org/stable/c/baf246d6680befde2086b1df9eb3aaba3fb6853f | kernel.org | |
| https://git.kernel.org/stable/c/de70da1fb1d152e981ecb3157f7ec2b633005c16 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-129 | Improper Validation of Array Index | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 4.14.317, < 4.15 >= 4.19.285, < 4.20 >= 5.4.245, < 5.5 >= 5.7.1, < 6.6.130 >= 6.7, < 6.12.78 >= 6.13, < 6.18.20 >= 6.19, < 6.19.10 5.7 - 7.0 rc1 7.0 rc2 7.0 rc3 7.0 rc4 7.0 rc5 7.0 rc6 7.0 rc7 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 14, 2026 | CVE Modified | kernel.org |
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | kernel.org |
| Apr 23, 2026 | Initial Analysis | [email protected] |
| Apr 3, 2026 | New CVE Received | kernel.org |