CVE-2026-31617

Vulnerability

In the Linux kernel's USB f_ncm gadget driver, the function ncm_unwrap_ntb() reads a block_len value from the NTB header supplied by the USB host. This value is only checked against an upper limit (ntb_max), but lacks a minimum validation. When block_len is smaller than opts->ndp_size, the subsequent bounds check ndp_index > (block_len - opts->ndp_size) underflows, producing a very large unsigned result that ndp_index can never exceed, effectively bypassing the check entirely. The same underflow occurs in the datagram index checks against block_len - opts->dpe_size [1][2][3][4].

Exploitation

A malicious USB host can exploit this by supplying a crafted NTB header with a block_len that is too small to hold the gadget device. Because the bounds checks are neutered by the underflow, the host can choose ndp_index and datagram offsets that point beyond the actual transfer buffer. No authentication is required beyond the ability to act as a USB host to the target gadget device.

Impact

With the bounds checks defeated, the driver's skb_put_data() call copies adjacent kernel memory into the network socket buffer (skb). This allows the attacker to leak sensitive kernel memory contents to the network layer, potentially exposing confidential data. The vulnerability is rated Medium (CVSS 5.5) and can lead to information disclosure.

Mitigation

The fix adds a lower-bound check that rejects block_len values too small to hold at least the NTB header plus one NDP, ensuring that block_len - opts->ndp_size and block_len - opts->dpe_size are always well-defined. The patch has been applied to the stable kernel branches as referenced [1][2][3][4]. Users should update to the latest patched kernel version.