{"id":"CVE-2026-23447","summary":"net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check\n\nThe same bounds-check bug fixed for NDP16 in the previous patch also\nexists in cdc_ncm_rx_verify_ndp32(). The DPE array size is validated\nagainst the total skb length without accounting for ndpoffset, allowing\nout-of-bounds reads when the NDP32 is placed near the end of the NTB.\n\nAdd ndpoffset to the nframes bounds check and use struct_size_t() to\nexpress the NDP-plus-DPE-array size more clearly.\n\nCompile-tested only.","modified":"2026-10-28T02:30:39.086777258Z","published":"2026-04-03T15:15:30.495Z","related":["SUSE-SU-2026:21834-1","SUSE-SU-2026:21841-1","SUSE-SU-2026:21845-1","SUSE-SU-2026:21860-1","SUSE-SU-2026:21876-1","SUSE-SU-2026:21877-1","SUSE-SU-2026:21916-1","SUSE-SU-2026:21919-1","SUSE-SU-2026:2217-1","SUSE-SU-2026:2238-1","openSUSE-SU-2026:20826-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23447.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/125f932a76a97904ef8a555f1dd53e5d0e288c54"},{"type":"WEB","url":"https://git.kernel.org/stable/c/77914255155e68a20aa41175edeecf8121dac391"},{"type":"WEB","url":"https://git.kernel.org/stable/c/a5bd5a2710310c965ea4153cba4210988a3454e2"},{"type":"WEB","url":"https://git.kernel.org/stable/c/af0d1613d6751489dbf9f69aac1123f0b1e566e5"},{"type":"WEB","url":"https://git.kernel.org/stable/c/baf246d6680befde2086b1df9eb3aaba3fb6853f"},{"type":"WEB","url":"https://git.kernel.org/stable/c/de70da1fb1d152e981ecb3157f7ec2b633005c16"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23447.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23447"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"0fa81b304a7973a499f844176ca031109487dd31"},{"fixed":"baf246d6680befde2086b1df9eb3aaba3fb6853f"},{"fixed":"125f932a76a97904ef8a555f1dd53e5d0e288c54"},{"fixed":"af0d1613d6751489dbf9f69aac1123f0b1e566e5"},{"fixed":"a5bd5a2710310c965ea4153cba4210988a3454e2"},{"fixed":"de70da1fb1d152e981ecb3157f7ec2b633005c16"},{"fixed":"77914255155e68a20aa41175edeecf8121dac391"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"4.14.317"},{"fixed":"4.15"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"4.19.285"},{"fixed":"4.20"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"5.4.245"},{"fixed":"5.5"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"8cf7db86a8984ffa3a3388a8df12bc0aa4c79bd7"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"4ca8b8855264cf1439cdab3da7049bd1e3c2a9e6"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"a270ca35a9499b58366d696d3290eaa4697a42db"}]}],"versions":["v4.14.336","v4.14.335","v4.14.334","v4.14.333","v4.14.332","v4.14.331","v4.14.330","v4.14.329","v4.14.328","v4.14.327","v4.14.326","v4.14.325","v4.14.324","v4.14.323","v4.14.322","v4.14.321","v4.14.320","v4.14.319","v4.14.318","v4.14.317","v4.19.325","v4.19.324","v4.19.323","v4.19.322","v4.19.321","v4.19.320","v4.19.319","v4.19.318","v4.19.317","v4.19.316","v4.19.315","v4.19.314","v4.19.313","v4.19.312","v4.19.311","v4.19.310","v4.19.309","v4.19.308","v4.19.307","v4.19.306","v4.19.305","v4.19.304","v4.19.303","v4.19.302","v4.19.301","v4.19.300","v4.19.299","v4.19.298","v4.19.297","v4.19.296","v4.19.295","v4.19.294","v4.19.293","v4.19.292","v4.19.291","v4.19.290","v4.19.289","v4.19.288","v4.19.287","v4.19.286","v4.19.285","v5.4.302","v5.4.301","v5.4.300","v5.4.299","v5.4.298","v5.4.297","v5.4.296","v5.4.295","v5.4.294","v5.4.293","v5.4.292","v5.4.291","v5.4.290","v5.4.289","v5.4.288","v5.4.287","v5.4.286","v5.4.285","v5.4.284","v5.4.283","v5.4.282","v5.4.281","v5.4.280","v5.4.279","v5.4.278","v5.4.277","v5.4.276","v5.4.275","v5.4.274","v5.4.273","v5.4.272","v5.4.271","v5.4.270","v5.4.269","v5.4.268","v5.4.267","v5.4.266","v5.4.265","v5.4.264","v5.4.263","v5.4.262","v5.4.261","v5.4.260","v5.4.259","v5.4.258","v5.4.257","v5.4.256","v5.4.255","v5.4.254","v5.4.253","v5.4.252","v5.4.251","v5.4.250","v5.4.249","v5.4.248","v5.4.247","v5.4.246","v5.4.245"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23447.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.0"},{"fixed":"6.1.188"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.130"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.78"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.20"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"6.19.10"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23447.json"}}],"schema_version":"1.9.2"}