CVE-2026-23448 Details
Description
In the Linux kernel, the following vulnerability has been resolved: net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check cdc_ncm_rx_verify_ndp16() validates that the NDP header and its DPE entries fit within the skb. The first check correctly accounts for ndpoffset: if ((ndpoffset + sizeof(struct usb_cdc_ncm_ndp16)) > skb_in->len) but the second check omits it: if ((sizeof(struct usb_cdc_ncm_ndp16) + ret * (sizeof(struct usb_cdc_ncm_dpe16))) > skb_in->len) This validates the DPE array size against the total skb length as if the NDP were at offset 0, rather than at ndpoffset. When the NDP is placed near the end of the NTB (large wNdpIndex), the DPE entries can extend past the skb data buffer even though the check passes. cdc_ncm_rx_fixup() then reads out-of-bounds memory when iterating the DPE array. Add ndpoffset to the nframes bounds check and use struct_size_t() to express the NDP-plus-DPE-array size more clearly.
A vulnerability has been identified in the Linux kernel's USB CDC NCM driver, specifically in the handling of NDP16 frames. The issue arises in the 'cdc_ncm_rx_verify_ndp16' function, which checks that the NDP header and its associated DPE entries fit within the provided socket buffer (skb). While the initial check correctly considers the NDP offset, the subsequent validation of the DPE array size against the total skb length fails to account for this offset. As a result, when the NDP is positioned near the end of the NTB, the DPE entries can overflow the skb data buffer, leading to an out-of-bounds memory read. This vulnerability has been addressed by modifying the bounds check to include the NDP offset and by using a clearer representation of the NDP and DPE array size.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for downloading the patched version are available on the Linux kernel official website.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/2aa8a4fa8d5b7d0e1ebcec100e1a4d80a1f4b21a | kernel.org | Patch |
| https://git.kernel.org/stable/c/403f94ddcb36c552fbef51dea735b131e3dcde8b | kernel.org | Patch |
| https://git.kernel.org/stable/c/63c35b8fce77a7892e8fa06c540d4943145506eb | kernel.org | |
| https://git.kernel.org/stable/c/789204f980730258c983102c027c375238009c80 | kernel.org | Patch |
| https://git.kernel.org/stable/c/dce9dda0e3707e887977db44407989e9ead26611 | kernel.org | Patch |
| https://git.kernel.org/stable/c/f1c7701d3ac91b62d672c13690cf295821f0d5c3 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-129 | Improper Validation of Array Index | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 3.8, < 6.6.130 >= 6.7, < 6.12.78 >= 6.13, < 6.18.20 >= 6.19, < 6.19.10 7.0 rc1 7.0 rc2 7.0 rc3 7.0 rc4 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 14, 2026 | CVE Modified | kernel.org |
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | kernel.org |
| May 21, 2026 | Initial Analysis | [email protected] |
| Apr 3, 2026 | New CVE Received | kernel.org |