CVE-2026-23447
Description
In the Linux kernel, the following vulnerability has been resolved: net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check The same bounds-check bug fixed for NDP16 in the previous patch also exists in cdc_ncm_rx_verify_ndp32(). The DPE array size is validated against the total skb length without accounting for ndpoffset, allowing out-of-bounds reads when the NDP32 is placed near the end of the NTB. Add ndpoffset to the nframes bounds check and use struct_size_t() to express the NDP-plus-DPE-array size more clearly. Compile-tested only.
How to fix
- linux linux_kernel4.15, 4.20, 5.5, 6.6.130, 6.12.78, 6.18.20, 6.19.10 or later
- git.kernel.org/stable/c/125f932a76a97904ef8a555f1dd53e5d0e288c54
- git.kernel.org/stable/c/77914255155e68a20aa41175edeecf8121dac391
- git.kernel.org/stable/c/a5bd5a2710310c965ea4153cba4210988a3454e2
- git.kernel.org/stable/c/af0d1613d6751489dbf9f69aac1123f0b1e566e5
- git.kernel.org/stable/c/de70da1fb1d152e981ecb3157f7ec2b633005c16
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | 4.14.317 ≤ v < 4.15, 4.19.285 ≤ v < 4.20, 5.4.245 ≤ v < 5.5, 5.7.1 ≤ v < 6.6.130, 6.7 ≤ v < 6.12.78, 6.13 ≤ v < 6.18.20, 6.19 ≤ v < 6.19.10, 5.7, 7.0 | 4.15, 4.20, 5.5, 6.6.130, 6.12.78, 6.18.20, 6.19.10 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.