Executive brief
A vulnerability in the Linux kernel's USB networking driver could allow a local attacker to cause a system crash or potentially access sensitive information. The issue occurs when the system processes specifically formatted network data from a USB device. This could impact the stability and security of systems using certain USB Ethernet or tethering adapters.
Technical details
An out-of-bounds read vulnerability exists in the cdc_ncm_rx_verify_ndp32() function within drivers/net/usb/cdc_ncm.c of the Linux kernel. The root cause is an improper validation of the Datagram Pointer Entry (DPE) array size, which fails to account for the 'ndpoffset' when performing bounds checks against the total socket buffer (skb) length. A local attacker can exploit this by placing an NDP32 structure near the end of a Network Transfer Block (NTB), leading to out-of-bounds memory access. This can result in a denial of service (system crash) or information disclosure. Patches have been released for various stable kernel branches.
Affected products
- Linux Linux 5.7 to 6.18.20
Timeline
- 2026-03-13: other: Patch authored
- 2026-04-03: advisory: Vulnerability published
References
- https://git.kernel.org/stable/c/125f932a76a97904ef8a555f1dd53e5d0e288c54
- https://git.kernel.org/stable/c/77914255155e68a20aa41175edeecf8121dac391
- https://git.kernel.org/stable/c/a5bd5a2710310c965ea4153cba4210988a3454e2
- https://git.kernel.org/stable/c/af0d1613d6751489dbf9f69aac1123f0b1e566e5
- https://git.kernel.org/stable/c/de70da1fb1d152e981ecb3157f7ec2b633005c16