CVE-2026-23448

A flaw was found in the Linux kernel's cdc_ncm module. An incorrect bounds check in the cdc_ncm_rx_verify_ndp16() function, responsible for validating Network Data Protocol (NDP) entries, allows Datagram Pointer Entries (DPE) to extend beyond the intended buffer. This can lead to an out-of-bounds read when cdc_ncm_rx_fixup() processes these entries, potentially resulting in information disclosure or a denial of service.

This vulnerability affects systems using USB CDC NCM (Network Control Model) devices such as USB tethering adapters and mobile broadband modems. Exploitation requires either a malicious USB device or crafted network packets to a connected CDC NCM device. The out-of-bounds read could leak kernel memory or cause a crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the cdc_ncm module from being loaded. See https://access.redhat.com/solutions/41278 for instructions. Note this will disable USB CDC NCM network devices.