CVE-2026-23448

Vulnerability

In the Linux kernel's cdc_ncm driver, the function cdc_ncm_rx_verify_ndp16() validates the NDP16 header and its DPE entries fit within the socket buffer. The first check correctly includes ndpoffset, but the second check, which validates the DPE array size, omits ndpoffset. This causes the function to treat the NDP as if it were at offset 0, allowing a large wNdpIndex to place the NDP near the end of the NTB, so DPE entries can extend past the skb data buffer even though the check passes [1][2].

Exploitation

An attacker with physical access to a USB port can plug a malicious USB device that presents crafted CDC NCM descriptors. When the kernel receives an NTB with a large wNdpIndex, the insufficient bounds check may allow out-of-bounds memory reads. No special privileges are required beyond the ability to attach the device, and the attack occurs during normal network packet processing [3][4].

Impact

Reading out-of-bounds kernel memory can leak sensitive data or cause a system crash (denial of service). In some scenarios, this may also be leveraged for privilege escalation or arbitrary code execution, depending on the memory layout.

Mitigation

The fix adds ndpoffset to the DPE array size check and uses struct_size_t() for clarity. The patch has been applied to stable kernel trees as of the referenced commits. Users should update to a kernel containing the fix.