CVE-2026-23447: Linux Kernel

High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check The same bounds-check bug fixed for NDP16 in the previous patch also exists in cdc_ncm_rx_verify_ndp32(). The DPE array size is validated against the total skb length without accounting for ndpoffset, allowing out-of-bounds reads when the NDP32 is placed near the end of the NTB. Add ndpoffset to the nframes bounds check and use struct_size_t() to express the NDP-plus-DPE-array size more clearly. Compile-tested only.

Affected products

• Linux Linux Kernel: from 4.14.317, before 4.15 (fixed in 4.15); from 4.19.285, before 4.20 (fixed in 4.20); from 5.4.245, before 5.5 (fixed in 5.5); from 5.7.1, before 6.6.130 (fixed in 6.6.130); from 6.7, before 6.12.78 (fixed in 6.12.78); from 6.13, before 6.18.20 (fixed in 6.18.20); …

Published 2026-04-03. Last modified 2026-09-14.