CVE-2026-23447
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check The same bounds-check bug fixed for NDP16 in the previous patch also exists in cdc_ncm_rx_verify_ndp32(). The DPE array size is validated against the total skb length without accounting for ndpoffset, allowing out-of-bounds reads when the NDP32 is placed near the end of the NTB. Add ndpoffset to the nframes bounds check and use struct_size_t() to express the NDP-plus-DPE-array size more clearly. Compile-tested only.
Severity
HIGH
CVSS score
7.8
(v3.1)
Vulnerability status
Modified
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-04-03 16:16:30.663000
Last modified
2026-11-05 22:18:26.660000
View original CVE JSON
{
"id": "CVE-2026-23447",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-04-03T16:16:30.663",
"lastModified": "2026-11-05T22:18:26.660",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check\n\nThe same bounds-check bug fixed for NDP16 in the previous patch also\nexists in cdc_ncm_rx_verify_ndp32(). The DPE array size is validated\nagainst the total skb length without accounting for ndpoffset, allowing\nout-of-bounds reads when the NDP32 is placed near the end of the NTB.\n\nAdd ndpoffset to the nframes bounds check and use struct_size_t() to\nexpress the NDP-plus-DPE-array size more clearly.\n\nCompile-tested only."
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet: usb: cdc_ncm: añadir ndpoffset a la comprobación de límites de nframes de NDP32\n\nEl mismo error de comprobación de límites corregido para NDP16 en el parche anterior también existe en cdc_ncm_rx_verify_ndp32(). El tamaño del array DPE se valida contra la longitud total del skb sin tener en cuenta ndpoffset, permitiendo lecturas fuera de límites cuando el NDP32 se coloca cerca del final del NTB.\n\nAñadir ndpoffset a la comprobación de límites de nframes y usar struct_size_t() para expresar el tamaño del array NDP-más-DPE más claramente.\n\nSolo probado en compilación."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"drivers/net/usb/cdc_ncm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "0fa81b304a7973a499f844176ca031109487dd31",
"lessThan": "baf246d6680befde2086b1df9eb3aaba3fb6853f",
"versionType": "git",
"status": "affected"
},
{
"version": "0fa81b304a7973a499f844176ca031109487dd31",
"lessThan": "125f932a76a97904ef8a555f1dd53e5d0e288c54",
"versionType": "git",
"status": "affected"
},
{
"version": "0fa81b304a7973a499f844176ca031109487dd31",
"lessThan": "af0d1613d6751489dbf9f69aac1123f0b1e566e5",
"versionType": "git",
"status": "affected"
},
{
"version": "0fa81b304a7973a499f844176ca031109487dd31",
"lessThan": "a5bd5a2710310c965ea4153cba4210988a3454e2",
"versionType": "git",
"status": "affected"
},
{
"version": "0fa81b304a7973a499f844176ca031109487dd31",
"lessThan": "de70da1fb1d152e981ecb3157f7ec2b633005c16",
"versionType": "git",
"status": "affected"
},
{
"version": "0fa81b304a7973a499f844176ca031109487dd31",
"lessThan": "77914255155e68a20aa41175edeecf8121dac391",
"versionType": "git",
"status": "affected"
},
{
"version": "8cf7db86a8984ffa3a3388a8df12bc0aa4c79bd7",
"versionType": "git",
"status": "affected"
},
{
"version": "4ca8b8855264cf1439cdab3da7049bd1e3c2a9e6",
"versionType": "git",
"status": "affected"
},
{
"version": "a270ca35a9499b58366d696d3290eaa4697a42db",
"versionType": "git",
"status": "affected"
},
{
"version": "4.14.317",
"lessThan": "4.15",
"versionType": "semver",
"status": "affected"
},
{
"version": "4.19.285",
"lessThan": "4.20",
"versionType": "semver",
"status": "affected"
},
{
"version": "5.4.245",
"lessThan": "5.5",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"drivers/net/usb/cdc_ncm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "5.7",
"status": "affected"
},
{
"version": "0",
"lessThan": "5.7",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.188",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.130",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.78",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18.20",
"lessThanOrEqual": "6.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.19.10",
"lessThanOrEqual": "6.19.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.0",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-11-05T21:31:15.822566Z",
"id": "CVE-2026-23447",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-129"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.317",
"versionEndExcluding": "4.15",
"matchCriteriaId": "E6109B59-9FDE-4746-B291-E7423EDF2A70"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.285",
"versionEndExcluding": "4.20",
"matchCriteriaId": "CE641959-B555-4CFF-822C-9888BDADDE4B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.245",
"versionEndExcluding": "5.5",
"matchCriteriaId": "CB2B154A-4B88-47C0-A49E-DBBF55809DED"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.7.1",
"versionEndExcluding": "6.6.130",
"matchCriteriaId": "D8B82BD0-E332-47C9-8A05-912A7C75676B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.7",
"versionEndExcluding": "6.12.78",
"matchCriteriaId": "28D591F5-B196-4CC9-905C-DC80F116E7A8"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.18.20",
"matchCriteriaId": "E5571059-6552-48E7-9BEF-3E358C387171"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.19",
"versionEndExcluding": "6.19.10",
"matchCriteriaId": "96D34333-38BE-4414-9E79-6EB764329581"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:5.7:-:*:*:*:*:*:*",
"matchCriteriaId": "3D23CE42-BDB2-4216-8495-230ABE98FCDD"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*",
"matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*",
"matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*",
"matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*",
"matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/125f932a76a97904ef8a555f1dd53e5d0e288c54",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/77914255155e68a20aa41175edeecf8121dac391",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/a5bd5a2710310c965ea4153cba4210988a3454e2",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/af0d1613d6751489dbf9f69aac1123f0b1e566e5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/baf246d6680befde2086b1df9eb3aaba3fb6853f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/de70da1fb1d152e981ecb3157f7ec2b633005c16",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}