PT-2026-30142 · Linux · Linux

Published 2026-04-03 · Updated 2026-04-03 · CVE-2026-23447

NVD

In the Linux kernel, the following vulnerability has been resolved:

net: usb: cdc ncm: add ndpoffset to NDP32 nframes bounds check

The same bounds-check bug fixed for NDP16 in the previous patch also exists in cdc ncm rx verify ndp32(). The DPE array size is validated against the total skb length without accounting for ndpoffset, allowing out-of-bounds reads when the NDP32 is placed near the end of the NTB.

Add ndpoffset to the nframes bounds check and use struct size t() to express the NDP-plus-DPE-array size more clearly.

Compile-tested only.

Related Identifiers

CVE-2026-23447

Affected Products

Linux

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-23447 · Security Note
• https://git.kernel.org/stable/c/125f932a76a97904ef8a555f1dd53e5d0e288c54 · Note
• https://git.kernel.org/stable/c/77914255155e68a20aa41175edeecf8121dac391 · Note
• https://git.kernel.org/stable/c/a5bd5a2710310c965ea4153cba4210988a3454e2 · Note
• https://git.kernel.org/stable/c/af0d1613d6751489dbf9f69aac1123f0b1e566e5 · Note
• https://git.kernel.org/stable/c/de70da1fb1d152e981ecb3157f7ec2b633005c16 · Note