CVE-2026-23447
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check
In the Linux kernel, the following vulnerability has been resolved: net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check The same bounds-check bug fixed for NDP16 in the previous patch also exists in cdc_ncm_rx_verify_ndp32(). The DPE array size is validated against the total skb length without accounting for ndpoffset, allowing out-of-bounds reads when the NDP32 is placed near the end of the NTB. Add ndpoffset to the nframes bounds check and use struct_size_t() to express the NDP-plus-DPE-array size more clearly. Compile-tested only.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0fa81b304a7973a499f844176ca031109487dd31 | affected | git | baf246d6680befde2086b1df9eb3aaba3fb6853f | Unavailable | None listed |
| 0fa81b304a7973a499f844176ca031109487dd31 | affected | git | 125f932a76a97904ef8a555f1dd53e5d0e288c54 | Unavailable | None listed |
| 0fa81b304a7973a499f844176ca031109487dd31 | affected | git | af0d1613d6751489dbf9f69aac1123f0b1e566e5 | Unavailable | None listed |
| 0fa81b304a7973a499f844176ca031109487dd31 | affected | git | a5bd5a2710310c965ea4153cba4210988a3454e2 | Unavailable | None listed |
| 0fa81b304a7973a499f844176ca031109487dd31 | affected | git | de70da1fb1d152e981ecb3157f7ec2b633005c16 | Unavailable | None listed |
| 0fa81b304a7973a499f844176ca031109487dd31 | affected | git | 77914255155e68a20aa41175edeecf8121dac391 | Unavailable | None listed |
| 8cf7db86a8984ffa3a3388a8df12bc0aa4c79bd7 | affected | git | Unavailable | Unavailable | None listed |
| 4ca8b8855264cf1439cdab3da7049bd1e3c2a9e6 | affected | git | Unavailable | Unavailable | None listed |
| a270ca35a9499b58366d696d3290eaa4697a42db | affected | git | Unavailable | Unavailable | None listed |
| 4.14.317 | affected | semver | 4.15 | Unavailable | None listed |
| 4.19.285 | affected | semver | 4.20 | Unavailable | None listed |
| 5.4.245 | affected | semver | 5.5 | Unavailable | None listed |
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
affected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 5.7 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 0 | unaffected | semver | 5.7 | Unavailable | None listed |
| 6.1.188 | unaffected | semver | Unavailable | 6.1.* | None listed |
| 6.6.130 | unaffected | semver | Unavailable | 6.6.* | None listed |
| 6.12.78 | unaffected | semver | Unavailable | 6.12.* | None listed |
| 6.18.20 | unaffected | semver | Unavailable | 6.18.* | None listed |
| 6.19.10 | unaffected | semver | Unavailable | 6.19.* | None listed |
| 7.0 | unaffected | original_commit_for_fix | Unavailable | * | None listed |