CVE-2026-74679 in Linux
Summary
by MITRE • 08/22/2026
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: f_ncm: Use unsigned int for ndp_index
The variable ndp_index is declared as a signed integer, but it stores the return value of get_ncm(), which is unsigned.
A malicious host can supply a large offset that overflows the signed ndp_index, making it negative. Because ndp_index is compared against unsigned bounds, this negative value bypasses sanity checks and leads to an out-of-bounds read when calculating the address of the NDP block (ntb_ptr + ndp_index).
Fix this by changing ndp_index to unsigned int to ensure consistent unsigned comparisons throughout the function.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/22/2026
The Linux kernel vulnerability identified in the USB gadget NCM driver involves a type mismatch that leads to an out-of-bounds memory read, classified under CWE-190 Integer Overflow and CWE-20 Improper Input Validation. The core technical flaw resides within the f_ncm module where the variable ndp_index is declared as a signed integer while it stores values derived from get_ncm(), which returns an unsigned type. This discrepancy creates a critical logic error during boundary checks because negative values resulting from overflow or large inputs can bypass sanity conditions that are designed to prevent access beyond allocated memory regions. When a malicious host supplies a sufficiently large offset, the value overflows into the signed integer range, becoming negative and thus passing comparisons against unsigned bounds which typically expect positive indices within valid array limits.
The operational impact of this vulnerability allows an attacker connected via USB NCM interface to trigger an out-of-bounds read operation when calculating the address of the Network Descriptor Pointer block by adding ndp_index to ntb_ptr. This memory access violation can lead to information disclosure if sensitive kernel data is exposed through the resulting invalid pointer dereference, or potentially cause a denial of service if the system attempts to handle the fault in an unstable manner. The attack vector requires physical or logical USB connectivity, placing it within the context of local or adjacent network attacks depending on deployment scenarios such as tethering devices or embedded systems with exposed USB ports.
From a threat modeling perspective aligned with MITRE ATT&CK frameworks, this vulnerability facilitates reconnaissance and potential privilege escalation through memory corruption techniques often associated with CWE-125 Out-of-bounds Read. The exploitation relies on the attacker's ability to control input parameters that directly influence pointer arithmetic within kernel space, highlighting the importance of strict type consistency in low-level system programming. Mitigation strategies involve applying the upstream patch which changes ndp_index from a signed integer to an unsigned int, ensuring consistent comparison semantics and preventing negative values from slipping past validation checks. System administrators should ensure their kernels are updated with this fix, particularly for devices exposing USB networking capabilities, while developers must enforce strict type checking in future implementations of similar descriptor parsing logic to prevent recurrence of such integer handling errors.