Skip to content
CVE PROGRAM SOURCE RECORD5.5 Medium

CVE-2026-31617

usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb()

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() The block_len read from the host-supplied NTB header is checked against ntb_max but has no lower bound. When block_len is smaller than opts->ndp_size, the bounds check of: ndp_index > (block_len - opts->ndp_size) will underflow producing a huge unsigned value that ndp_index can never exceed, defeating the check entirely. The same underflow occurs in the datagram index checks against block_len - opts->dpe_size. With those checks neutered, a malicious USB host can choose ndp_index and datagram offsets that point past the actual transfer, and the skb_put_data() copies adjacent kernel memory into the network skb. Fix this by rejecting block lengths that cannot hold at least the NTB header plus one NDP. This will make block_len - opts->ndp_size and block_len - opts->dpe_size both well-defined. Commit 8d2b1a1ec9f5 ("CDC-NCM: avoid overflow in sanity checking") fixed a related class of issues on the host side of NCM.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 2b74b0a04d3e9f9f08ff026e5663dce88ff94e52 to < 068a7f2749fff6462a0a908ec415b885fe430f50affected
  • 2b74b0a04d3e9f9f08ff026e5663dce88ff94e52 to < 1425655c2870054c3ab4712e2b6dbdd331597adaaffected
  • 2b74b0a04d3e9f9f08ff026e5663dce88ff94e52 to < 8b3b7bd3c02f98634baaf36c7fc7ac915f6517caaffected
  • 2b74b0a04d3e9f9f08ff026e5663dce88ff94e52 to < 0f156bb5334e588034ca68ac2ee92b23f66e56e7affected
  • 2b74b0a04d3e9f9f08ff026e5663dce88ff94e52 to < 8757a2593631443648218244b9788e193ae0fdc1affected
  • 2b74b0a04d3e9f9f08ff026e5663dce88ff94e52 to < 6762f8a95772265dd0c2ffe7f400493f3115b135affected
  • 2b74b0a04d3e9f9f08ff026e5663dce88ff94e52 to < d58ba8f6546232f8414f396c189297dbee03f1a7affected
  • 2b74b0a04d3e9f9f08ff026e5663dce88ff94e52 to < 74908b0318d1df1188457040b8714ff4d4b68126affected
  • 2b74b0a04d3e9f9f08ff026e5663dce88ff94e52 to < 8f993d30b95dc9557a8a96ceca11abed674c8acbaffected
  • f7e0611e207d8908c4f2858e244370529a76dbf7affected
  • b88ad6e714284b33a47834f5f2a294c2b37c66aaaffected
  • 471b23586387a32857778c511be60ab31c98dcfdaffected
  • 4f529c4d1e436230d3af7c09a3239677a14d2b46affected
  • ae6a5394d9fbe118bc95cfe376d6a9d91d7547e8affected
  • 4.9.235 to < 4.10affected
  • 4.14.196 to < 4.15affected
  • 4.19.143 to < 4.20affected
  • 5.4.62 to < 5.5affected
  • 5.8.6 to < 5.9affected

Linux Linux

Default version status: affected

  • 5.9affected
  • 0 to < 5.9unaffected
  • 5.10.258 to ≤ 5.10.*unaffected
  • 5.15.209 to ≤ 5.15.*unaffected
  • 6.1.175 to ≤ 6.1.*unaffected
  • 6.6.136 to ≤ 6.6.*unaffected
  • 6.12.83 to ≤ 6.12.*unaffected
  • 6.18.24 to ≤ 6.18.*unaffected
  • 6.19.14 to ≤ 6.19.*unaffected
  • 7.0.1 to ≤ 7.0.*unaffected
  • 7.1 to ≤ *unaffected

References