CVE-2026-74679

usb: gadget: f_ncm: Use unsigned int for ndp_index

State: Published
Severity: Not scored
Published: Aug 22, 2026
Updated: Aug 22, 2026
Reserved: Aug 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_ncm: Use unsigned int for ndp_index

The variable ndp_index is declared as a signed integer, but it stores the return value of get_ncm(), which is unsigned.

A malicious host can supply a large offset that overflows the signed ndp_index, making it negative. Because ndp_index is compared against unsigned bounds, this negative value bypasses sanity checks and leads to an out-of-bounds read when calculating the address of the NDP block (ntb_ptr + ndp_index).

Fix this by changing ndp_index to unsigned int to ensure consistent unsigned comparisons throughout the function.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	370af734dfaf8336b496b386e194648e097e248a to before 9c8c6825a750fcd3efbe922847ca70ccd5a66857Affected 370af734dfaf8336b496b386e194648e097e248a to before a1c0deeba4a46481543d6b09c665f758c54c3a1aAffected 370af734dfaf8336b496b386e194648e097e248a to before d13f650a3485b58c124b3cda45597e8002c9c833Affected 370af734dfaf8336b496b386e194648e097e248a to before 11413d7ed42174b8f5d8d0b6a25d10dc88239b21Affected 370af734dfaf8336b496b386e194648e097e248a to before 5b2b3a3229a3f4c493ffdee53aee2f173b6f13b3Affected 370af734dfaf8336b496b386e194648e097e248a to before d328fdc607fa1bb668ad512e1c918a120f78f337Affected 370af734dfaf8336b496b386e194648e097e248a to before fc9e54e22845c4da29588ca0986cb7c795b5a262Affected 370af734dfaf8336b496b386e194648e097e248a to before 6b1c8a9403a26cb0fed7a648916c74dc236da591Affected
LinuxLinux	3.17Affected before 3.17Not affected 5.10.265 through 5.10.Not affected 5.15.216 through 5.15.Not affected 6.1.183 through 6.1.Not affected 6.6.152 through 6.6.Not affected 6.12.104 through 6.12.Not affected 6.18.45 through 6.18.Not affected 7.1.9 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

370af734dfaf8336b496b386e194648e097e248a to before 9c8c6825a750fcd3efbe922847ca70ccd5a66857Affected
370af734dfaf8336b496b386e194648e097e248a to before a1c0deeba4a46481543d6b09c665f758c54c3a1aAffected
370af734dfaf8336b496b386e194648e097e248a to before d13f650a3485b58c124b3cda45597e8002c9c833Affected
370af734dfaf8336b496b386e194648e097e248a to before 11413d7ed42174b8f5d8d0b6a25d10dc88239b21Affected
370af734dfaf8336b496b386e194648e097e248a to before 5b2b3a3229a3f4c493ffdee53aee2f173b6f13b3Affected
370af734dfaf8336b496b386e194648e097e248a to before d328fdc607fa1bb668ad512e1c918a120f78f337Affected
370af734dfaf8336b496b386e194648e097e248a to before fc9e54e22845c4da29588ca0986cb7c795b5a262Affected
370af734dfaf8336b496b386e194648e097e248a to before 6b1c8a9403a26cb0fed7a648916c74dc236da591Affected

LinuxLinux

3.17Affected
before 3.17Not affected
5.10.265 through 5.10.*Not affected
5.15.216 through 5.15.*Not affected
6.1.183 through 6.1.*Not affected
6.6.152 through 6.6.*Not affected
6.12.104 through 6.12.*Not affected
6.18.45 through 6.18.*Not affected
7.1.9 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.