CVE-2026-31617

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb()

The block_len read from the host-supplied NTB header is checked against
ntb_max but has no lower bound. When block_len is smaller than
opts->ndp_size, the bounds check of:
ndp_index > (block_len – opts->ndp_size)
will underflow producing a huge unsigned value that ndp_index can never
exceed, defeating the check entirely.

The same underflow occurs in the datagram index checks against block_len
– opts->dpe_size. With those checks neutered, a malicious USB host can
choose ndp_index and datagram offsets that point past the actual
transfer, and the skb_put_data() copies adjacent kernel memory into the
network skb.

Fix this by rejecting block lengths that cannot hold at least the NTB
header plus one NDP. This will make block_len – opts->ndp_size and
block_len – opts->dpe_size both well-defined.

Commit 8d2b1a1ec9f5 (“CDC-NCM: avoid overflow in sanity checking”) fixed
a related class of issues on the host side of NCM.

More information : https://git.kernel.org/stable/c/0f156bb5334e588034ca68ac2ee92b23f66e56e7