In the Linux kernel, the following vulnerability has been resolved:
net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check
cdc_ncm_rx_verify_ndp16() validates that the NDP header and its DPE
entries fit within the skb. The first check correctly accounts for
ndpoffset:
if ((ndpoffset + sizeof(struct usb_cdc_ncm_ndp16)) > skb_in->len)
but the second check omits it:
if ((sizeof(struct usb_cdc_ncm_ndp16) +
ret * (sizeof(struct usb_cdc_ncm_dpe16))) > skb_in->len)
This validates the DPE array size against the total skb length as if
the NDP were at offset 0, rather than at ndpoffset. When the NDP is
placed near the end of the NTB (large wNdpIndex), the DPE entries can
extend past the skb data buffer even though the check passes.
cdc_ncm_rx_fixup() then reads out-of-bounds memory when iterating
the DPE array.
Add ndpoffset to the nframes bounds check and use struct_size_t() to
express the NDP-plus-DPE-array size more clearly.
References
Configurations
Configuration 1 (hide)
|
History
21 May 2026, 00:44
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
| CPE | cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:* |
|
| First Time |
Linux linux Kernel
Linux |
|
| CWE | CWE-129 | |
| References | () https://git.kernel.org/stable/c/2aa8a4fa8d5b7d0e1ebcec100e1a4d80a1f4b21a - Patch | |
| References | () https://git.kernel.org/stable/c/403f94ddcb36c552fbef51dea735b131e3dcde8b - Patch | |
| References | () https://git.kernel.org/stable/c/789204f980730258c983102c027c375238009c80 - Patch | |
| References | () https://git.kernel.org/stable/c/dce9dda0e3707e887977db44407989e9ead26611 - Patch | |
| References | () https://git.kernel.org/stable/c/f1c7701d3ac91b62d672c13690cf295821f0d5c3 - Patch |
03 Apr 2026, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-03 16:16
Updated : 2026-05-21 00:44
NVD link : CVE-2026-23448
Mitre link : CVE-2026-23448
CVE.ORG link : CVE-2026-23448
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-129
Improper Validation of Array Index