CVE-2026-68368 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb()
When unpacking host-supplied NTBs, ncm_unwrap_ntb() checks datagram length against frame_max but does not verify that the datagram fits within the declared block length. Additionally, when decoding multiple NTBs from a single socket buffer, subsequent block lengths are not checked against the actual remaining buffer data.
With these checks missing, a malicious USB host can specify datagram offsets and lengths that point beyond the block, or supply secondary NTB headers declaring lengths larger than the buffer. skb_put_data() then copies adjacent kernel memory from skb_shared_info into the network skb.
Fix this by verifying that sufficient buffer space remains for the NTB header before parsing, handling zero-length block declarations, ensuring that block lengths never exceed the remaining buffer space, and verifying that each datagram payload stays strictly within the block boundary.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability exists in the linux kernel's usb gadget function ncm implementation where the ncm_unwrap_ntb() function fails to properly validate datagram bounds when processing host-supplied network transfer blocks. The flaw occurs during the unpacking of ntbs which are used for usb network communication between host and device. Without proper validation of datagram boundaries against declared block lengths, an attacker can manipulate the ntbs to point beyond valid memory regions. This represents a classic buffer overflow condition where kernel memory adjacent to socket buffers becomes accessible through improper bounds checking.
The technical implementation issue stems from insufficient input validation within the usb gadget subsystem specifically targeting the ncm (network control model) function driver. When processing multiple ntbs from a single socket buffer, the function does not validate that subsequent block lengths remain within the actual remaining buffer data. This creates a scenario where a malicious host can craft ntbs with oversized block declarations or incorrect datagram offsets that exceed available buffer space. The vulnerability is classified under cwe-129 input validation and bounds checking issues, specifically CWE-129 which addresses insufficient bounds checking of array data.
The operational impact of this vulnerability is severe as it allows for arbitrary kernel memory read access through the skb_put_data() function call. When malicious datagram lengths are processed, the kernel copies adjacent memory from skb_shared_info into network skbs, potentially exposing sensitive kernel data including credentials, cryptographic keys, or other confidential information. This type of vulnerability enables privilege escalation attacks and can be leveraged to gain full control over the affected system. The attack surface is particularly concerning in embedded devices or usb network interfaces where malicious hosts might have physical access to the device.
The fix implemented addresses multiple validation checks that were previously missing from the ncm_unwrap_ntb() function. First, it ensures sufficient buffer space exists for ntb headers before parsing begins, preventing premature access to memory regions. Second, it properly handles zero-length block declarations that could cause division by zero or invalid pointer arithmetic. Third, it validates that block lengths never exceed remaining buffer space during multi-ntb processing, ensuring proper bounds enforcement. Finally, it verifies each datagram payload stays strictly within declared block boundaries, preventing out-of-bounds memory access. This remediation aligns with the principle of least privilege and input validation as recommended in the mitre att&ck framework under technique T1068 privilege escalation through kernel exploits. The solution follows secure coding practices that prevent buffer overflows and memory corruption vulnerabilities commonly exploited in kernel-level attacks.