CVE-2026-74679

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> usb: gadget: f_ncm: Use unsigned int for ndp_index<br /> <br /> The variable ndp_index is declared as a signed integer, but it stores<br /> the return value of get_ncm(), which is unsigned.<br /> <br /> A malicious host can supply a large offset that overflows the signed<br /> ndp_index, making it negative. Because ndp_index is compared against<br /> unsigned bounds, this negative value bypasses sanity checks and leads<br /> to an out-of-bounds read when calculating the address of the NDP<br /> block (ntb_ptr + ndp_index).<br /> <br /> Fix this by changing ndp_index to unsigned int to ensure consistent<br /> unsigned comparisons throughout the function.