CVE-2026-74679usb: gadget: f_ncm: Use unsigned int for ndp_index
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_ncm: Use unsigned int for ndp_index The variable ndp_index is declared as a signed integer, but it stores the return value of get_ncm(), which is unsigned. A malicious host can supply a large offset that overflows the signed ndp_index, making it negative. Because ndp_index is compared against unsigned bounds, this negative value bypasses sanity checks and leads to an out-of-bounds read when calculating the address of the NDP block (ntb_ptr + ndp_index). Fix this by changing ndp_index to unsigned int to ensure consistent unsigned comparisons throughout the function.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 22, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 370af734dfaf8336b496b386e194648e097e248a builds before 9c8c6825a750fcd3efbe922847ca70ccd5a66857; from 370af734dfaf8336b496b386e194648e097e248a before a1c0deeba4a46481543d6b09c665f758c54c3a1a; from 370af734dfaf8336b496b386e194648e097e248a before d13f650a3485b58c124b3cda45597e8002c9c833; from 370af734dfaf8336b496b386e194648e097e248a before 11413d7ed42174b8f5d8d0b6a25d10dc88239b21; 370af734dfaf8336b496b386e194648e097e248a builds before 5b2b3a3229a3f4c493ffdee53aee2f173b6f13b3; from 370af734dfaf8336b496b386e194648e097e248a before d328fdc607fa1bb668ad512e1c918a120f78f337; from 370af734dfaf8336b496b386e194648e097e248a before fc9e54e22845c4da29588ca0986cb7c795b5a262; 370af734dfaf8336b496b386e194648e097e248a builds before 6b1c8a9403a26cb0fed7a648916c74dc236da591 | CNA record |
References
- https://git.kernel.org/stable/c/9c8c6825a750fcd3efbe922847ca70ccd5a66857
- https://git.kernel.org/stable/c/a1c0deeba4a46481543d6b09c665f758c54c3a1a
- https://git.kernel.org/stable/c/d13f650a3485b58c124b3cda45597e8002c9c833
- https://git.kernel.org/stable/c/11413d7ed42174b8f5d8d0b6a25d10dc88239b21
- https://git.kernel.org/stable/c/5b2b3a3229a3f4c493ffdee53aee2f173b6f13b3
- https://git.kernel.org/stable/c/d328fdc607fa1bb668ad512e1c918a120f78f337
- https://git.kernel.org/stable/c/fc9e54e22845c4da29588ca0986cb7c795b5a262
- https://git.kernel.org/stable/c/6b1c8a9403a26cb0fed7a648916c74dc236da591
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.