PT-2026-30142 · Linux · Linux Kernel

Published 2026-04-03 · Updated 2026-05-03 · CVE-2026-23447

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A bounds-check issue exists in the cdc ncm rx verify ndp32() function within the Linux kernel's networking subsystem for USB Network (cdc ncm). The issue arises from a failure to account for ndpoffset when validating the DPE array size against the total skb length, potentially leading to out-of-bounds reads when the NDP32 is positioned near the end of the NTB. The fix involves adding ndpoffset to the nframes bounds check and using struct size t() to clarify the NDP-plus-DPE-array size.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Validation of Array Index

Weakness Enumeration

CWE-129

Related Identifiers

CVE-2026-23447

ECHO-B1E1-3445-E2BF

OESA-2026-2172

OESA-2026-2173

OESA-2026-2176

Affected Products

Linux Kernel

References · 44

• https://nvd.nist.gov/vuln/detail/CVE-2025-27558 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23449 · Security Note
• https://osv.dev/vulnerability/BELL-CVE-2026-23447 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-71089 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23457 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-23447 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2176 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31428 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23407 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23447 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-23447 · Security Note
• https://git.kernel.org/stable/c/de70da1fb1d152e981ecb3157f7ec2b633005c16 · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-23447 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23455 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23096 · Security Note