CVE-2026-23448 net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check
A missing bounds check in the Linux kernel's CDC NCM USB driver allows out-of-bounds memory reads, potentially leading to crashes or code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23448?
CVE-2026-23448 is a high-severity memory corruption vulnerability in Linux kernel, published on 3 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check
cdc_ncm_rx_verify_ndp16() validates that the NDP header and its DPE entries fit within the skb. The first check correctly accounts for ndpoffset:
if ((ndpoffset + sizeof(struct usb_cdc_ncm_ndp16)) > skb_in->len)
but the second check omits it:
if ((sizeof(struct usb_cdc_ncm_ndp16) + ret * (sizeof(struct usb_cdc_ncm_dpe16))) > skb_in->len)
This validates the DPE array size against the total skb length as if the NDP were at offset 0, rather than at ndpoffset. When the NDP is placed near the end of the NTB (large wNdpIndex), the DPE entries can extend past the skb data buffer even though the check passes. cdc_ncm_rx_fixup() then reads out-of-bounds memory when iterating the DPE array.
Add ndpoffset to the nframes bounds check and use struct_size_t() to express the NDP-plus-DPE-array size more clearly.
Weakness: CWE-129
Which versions are affected by CVE-2026-23448?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-23448?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-23448 being exploited?
There is no known exploitation of CVE-2026-23448 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-23448, DEBIAN-CVE-2026-23448, GHSA-pjhh-88pp-3hg6, ROOT-OS-DEBIAN-11-CVE-2026-23448, ROOT-OS-DEBIAN-12-CVE-2026-23448, ROOT-OS-DEBIAN-13-CVE-2026-23448 and 3 more.