PT-2026-30143 · Linux · Linux Kernel

Published 2026-04-03 · Updated 2026-04-03 · CVE-2026-23448

Positive Technologies · (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contains a flaw within the cdc ncm rx verify ndp16() function where the bounds check for NDP16 nframes omits the ndpoffset value. This allows the DPE entries to extend past the skb data buffer when the NDP is placed near the end of the NTB, leading to out-of-bounds memory reads in cdc ncm rx fixup() during DPE array iteration.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-23448

Affected Products

Linux Kernel

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-23448 · Security Note
• https://git.kernel.org/stable/c/789204f980730258c983102c027c375238009c80 · Note
• https://git.kernel.org/stable/c/403f94ddcb36c552fbef51dea735b131e3dcde8b · Note
• https://twitter.com/CVEnew/status/2040111882758189480 · Twitter Post
• https://git.kernel.org/stable/c/f1c7701d3ac91b62d672c13690cf295821f0d5c3 · Note
• https://git.kernel.org/stable/c/dce9dda0e3707e887977db44407989e9ead26611 · Note
• https://git.kernel.org/stable/c/2aa8a4fa8d5b7d0e1ebcec100e1a4d80a1f4b21a · Note