Executive brief
A vulnerability in the Linux kernel's USB gadget driver could allow a malicious USB host to cause a system crash or potentially access sensitive information. The issue occurs when the system processes specially crafted network data packets from a connected USB device. This could lead to operational disruptions or unauthorized data exposure on systems using the USB NCM (Network Control Model) gadget functionality.
Technical details
An integer underflow vulnerability exists in the f_ncm USB gadget driver within the ncm_unwrap_ntb() function. The driver fails to enforce a lower bound on the 'block_len' field provided in the NTB header. When 'block_len' is smaller than the expected NDP (Network Data Pointer) size, unsigned subtraction results in an underflow, bypassing subsequent bounds checks. A malicious USB host can exploit this to specify offsets pointing outside the intended transfer buffer, causing skb_put_data() to copy adjacent kernel memory into network packets or causing a denial of service. The fix introduces a check to reject block lengths that cannot accommodate at least the NTB header and one NDP.
Affected products
- Linux Linux Kernel 5.9 to 6.6.136, 6.12 to 6.12.83, 6.13 to 6.18.24, 6.19 to 6.19.14, 7.0 to 7.0.1
Timeline
- 2026-04-24: disclosed
- 2026-04-24: advisory
- 2026-06-01: patched
References
- https://git.kernel.org/stable/c/068a7f2749fff6462a0a908ec415b885fe430f50
- https://git.kernel.org/stable/c/0f156bb5334e588034ca68ac2ee92b23f66e56e7
- https://git.kernel.org/stable/c/1425655c2870054c3ab4712e2b6dbdd331597ada
- https://git.kernel.org/stable/c/6762f8a95772265dd0c2ffe7f400493f3115b135
- https://git.kernel.org/stable/c/74908b0318d1df1188457040b8714ff4d4b68126
- https://git.kernel.org/stable/c/8757a2593631443648218244b9788e193ae0fdc1
- https://git.kernel.org/stable/c/8b3b7bd3c02f98634baaf36c7fc7ac915f6517ca