CVE-2026-23447

A flaw was found in the USB CDC NCM (Network Control Model) driver in the Linux kernel. This vulnerability, a bounds-check bug, occurs when processing NCM Datagram Pointer (NDP32) frames. It fails to correctly account for the ndpoffset, which can lead to out-of-bounds reads. This could result in information disclosure or system instability.

This mirrors the NDP16 fix: the DPE array length was checked as if the NDP sat at offset zero. Malicious or buggy USB NCM frames can trigger small OOB reads during receive processing. Impact is limited to systems with CDC NCM USB networking.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the cdc_ncm module from being loaded. See https://access.redhat.com/solutions/41278 for instructions.