CVE-2026-31617

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb()<br /> <br /> The block_len read from the host-supplied NTB header is checked against<br /> ntb_max but has no lower bound. When block_len is smaller than<br /> opts-&gt;ndp_size, the bounds check of:<br /> ndp_index &gt; (block_len - opts-&gt;ndp_size)<br /> will underflow producing a huge unsigned value that ndp_index can never<br /> exceed, defeating the check entirely.<br /> <br /> The same underflow occurs in the datagram index checks against block_len<br /> - opts-&gt;dpe_size. With those checks neutered, a malicious USB host can<br /> choose ndp_index and datagram offsets that point past the actual<br /> transfer, and the skb_put_data() copies adjacent kernel memory into the<br /> network skb.<br /> <br /> Fix this by rejecting block lengths that cannot hold at least the NTB<br /> header plus one NDP. This will make block_len - opts-&gt;ndp_size and<br /> block_len - opts-&gt;dpe_size both well-defined.<br /> <br /> Commit 8d2b1a1ec9f5 ("CDC-NCM: avoid overflow in sanity checking") fixed<br /> a related class of issues on the host side of NCM.