CVE-2026-23447
published 2026-04-03CVE-2026-23447: In the Linux kernel, the following vulnerability has been resolved: net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check The same bounds-check bug…
PriorityP340high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.13%
2.9th percentile
In the Linux kernel, the following vulnerability has been resolved:
net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check
The same bounds-check bug fixed for NDP16 in the previous patch also
exists in cdc_ncm_rx_verify_ndp32(). The DPE array size is validated
against the total skb length without accounting for ndpoffset, allowing
out-of-bounds reads when the NDP32 is placed near the end of the NTB.
Add ndpoffset to the nframes bounds check and use struct_size_t() to
express the NDP-plus-DPE-array size more clearly.
Compile-tested only.
Affected
30 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.19.10-1 (forky) | linux 6.19.10-1 (forky) |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | >= 0fa81b304a7973a499f844176ca031109487dd31 < 125f932a76a97904ef8a555f1dd53e5d0e288c54 | 125f932a76a97904ef8a555f1dd53e5d0e288c54 |
| linux | linux | >= 0fa81b304a7973a499f844176ca031109487dd31 < af0d1613d6751489dbf9f69aac1123f0b1e566e5 | af0d1613d6751489dbf9f69aac1123f0b1e566e5 |
| linux | linux | >= 0fa81b304a7973a499f844176ca031109487dd31 < a5bd5a2710310c965ea4153cba4210988a3454e2 | a5bd5a2710310c965ea4153cba4210988a3454e2 |
| linux | linux | >= 0fa81b304a7973a499f844176ca031109487dd31 < de70da1fb1d152e981ecb3157f7ec2b633005c16 | de70da1fb1d152e981ecb3157f7ec2b633005c16 |
| linux | linux | >= 0fa81b304a7973a499f844176ca031109487dd31 < 77914255155e68a20aa41175edeecf8121dac391 | 77914255155e68a20aa41175edeecf8121dac391 |
| linux | linux | >= 4.14.317 < 4.15 | 4.15 |
| linux | linux | >= 4.19.285 < 4.20 | 4.20 |
| linux | linux | >= 5.4.245 < 5.5 | 5.5 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.19.10-1 | 6.19.10-1 |
| linux | linux_kernel | >= 4.14.317 < 4.15 | 4.15 |
| linux | linux_kernel | >= 4.19.285 < 4.20 | 4.20 |
| linux | linux_kernel | >= 5.4.245 < 5.5 | 5.5 |
| linux | linux_kernel | >= 5.7.1 < 6.6.130 | 6.6.130 |
| linux | linux_kernel | >= 6.13 < 6.18.20 | 6.18.20 |
| linux | linux_kernel | >= 6.19 < 6.19.10 | 6.19.10 |
| linux | linux_kernel | >= 6.7 < 6.12.78 | 6.12.78 |
| ubuntu | linux | — | — |
| ubuntu | linux-gcp | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_redhat6.6MEDIUM
vendor_ubuntu2.0LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-vf6v-fqr8-5xhj: In the Linux kernel, the following vulnerability has been resolved:
net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check
The same bounds-c
ghsa_unreviewed·2026-04-03
CVE-2026-23447 GHSA-vf6v-fqr8-5xhj: In the Linux kernel, the following vulnerability has been resolved:
net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check
The same bounds-c
In the Linux kernel, the following vulnerability has been resolved:
net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check
The same bounds-check bug fixed for NDP16 in the previous patch also
exists in cdc_ncm_rx_verify_ndp32(). The DPE array size is validated
against the total skb length without accounting for ndpoffset, allowing
out-of-bounds reads when the NDP32 is placed near the end of the NTB.
Add ndpoffset to the nframes bounds check and use struct_size_t() to
express the NDP-plus-DPE-array size more clearly.
Compile-tested only.
OSV
CVE-2026-23447: In the Linux kernel, the following vulnerability has been resolved: net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check The same bounds-che
osv·2026-04-03
CVE-2026-23447 CVE-2026-23447: In the Linux kernel, the following vulnerability has been resolved: net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check The same bounds-che
In the Linux kernel, the following vulnerability has been resolved: net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check The same bounds-check bug fixed for NDP16 in the previous patch also exists in cdc_ncm_rx_verify_ndp32(). The DPE array size is validated against the total skb length without accounting for ndpoffset, allowing out-of-bounds reads when the NDP32 is placed near the end of the NTB. Add ndpoffset to the nframes bounds check and use struct_size_t() to express the NDP-plus-DPE-array size more clearly. Compile-tested only.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-20·CVSS 2.0
CVE-2026-46073 [LOW] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A local attacke
Red Hat
kernel: net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check
vendor_redhat·2026-04-03·CVSS 6.6
CVE-2026-23447 [MEDIUM] CWE-131 kernel: net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check
kernel: net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check
In the Linux kernel, the following vulnerability has been resolved:
net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check
The same bounds-check bug fixed for NDP16 in the previous patch also
exists in cdc_ncm_rx_verify_ndp32(). The DPE array size is validated
against the total skb length without accounting for ndpoffset, allowing
out-of-bounds reads when the NDP32 is placed near the end of the NTB.
Add ndpoffset to the nframes bounds check and use struct_size_t() to
express the NDP-plus-DPE-array size more clearly.
Compile-tested only.
A flaw was found in the USB CDC NCM (Network Control Model) driver in the Linux kernel. This vulnerability, a bounds-check bug, occurs when processing NCM Datagram Pointer (NDP
Debian
CVE-2026-23447: linux - In the Linux kernel, the following vulnerability has been resolved: net: usb: c...
vendor_debian·2026
CVE-2026-23447 CVE-2026-23447: linux - In the Linux kernel, the following vulnerability has been resolved: net: usb: c...
In the Linux kernel, the following vulnerability has been resolved: net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check The same bounds-check bug fixed for NDP16 in the previous patch also exists in cdc_ncm_rx_verify_ndp32(). The DPE array size is validated against the total skb length without accounting for ndpoffset, allowing out-of-bounds reads when the NDP32 is placed near the end of the NTB. Add ndpoffset to the nframes bounds check and use struct_size_t() to express the NDP-plus-DPE-array size more clearly. Compile-tested only.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 6.19.10-1)
sid: resolved (fixed in 6.19.10-1)
trixie: open
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-23447 kernel: net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check
bugzilla·2026-04-03·CVSS 7.8
CVE-2026-23447 [HIGH] CVE-2026-23447 kernel: net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check
CVE-2026-23447 kernel: net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check
In the Linux kernel, the following vulnerability has been resolved:
net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check
The same bounds-check bug fixed for NDP16 in the previous patch also
exists in cdc_ncm_rx_verify_ndp32(). The DPE array size is validated
against the total skb length without accounting for ndpoffset, allowing
out-of-bounds reads when the NDP32 is placed near the end of the NTB.
Add ndpoffset to the nframes bounds check and use struct_size_t() to
express the NDP-plus-DPE-array size more clearly.
Compile-tested only.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026040315-CVE-2026-23447-dd25@gregkh/T
Wiz
CVE-2026-23447 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz
CVE-2026-23447 CVE-2026-23447 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-23447 :
Linux Kernel vulnerability analysis and mitigation
In the Linux kernel, the following vulnerability has been resolved:
net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check
The same bounds-check bug fixed for NDP16 in the previous patch also
exists in cdc_ncm_rx_verify_ndp32(). The DPE array size is validated
against the total skb length without accounting for ndpoffset, allowing
out-of-bounds reads when the NDP32 is placed near the end of the NTB.
Add ndpoffset to the nframes bounds check and use struct_size_t() to
express the NDP-plus-DPE-array size more clearly.
Compile-tested only.
Source : NVD
Published April 3, 2026
CNA Score N/A
Affected Technologies
Linux Kernel
Linux Debian
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release D
https://git.kernel.org/stable/c/125f932a76a97904ef8a555f1dd53e5d0e288c54https://git.kernel.org/stable/c/77914255155e68a20aa41175edeecf8121dac391https://git.kernel.org/stable/c/a5bd5a2710310c965ea4153cba4210988a3454e2https://git.kernel.org/stable/c/af0d1613d6751489dbf9f69aac1123f0b1e566e5https://git.kernel.org/stable/c/de70da1fb1d152e981ecb3157f7ec2b633005c16
2026-04-03
Published