PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-23448 Linux CVE debrief

CVE-2026-23448 is a Linux kernel bug in the usb:cdc_ncm receive path. The NDP16 verifier correctly checked the NDP header against the skb length using ndpoffset, but it did not include ndpoffset when validating the DPE array size. As a result, when the NDP is positioned near the end of the NTB, the DPE entries can extend past the skb buffer and cdc_ncm_rx_fixup() may read out of bounds while iterating the frame descriptors. NVD rates the issue 7.8/High and maps it to CWE-129. The kernel fix adds ndpoffset to the bounds check and uses struct_size_t() to express the full NDP-plus-DPE size more clearly.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-03
Original CVE updated
2026-09-14
Advisory published
2026-04-03
Advisory updated
2026-09-14

Who should care

Linux kernel maintainers, distribution security teams, and operators of affected systems that use the cdc_ncm USB networking driver—especially where local attackers may be able to interact with the device path.

Technical summary

cdc_ncm_rx_verify_ndp16() validates an NDP16 structure and its DPE array. The bug is that the second size check treated the NDP as if it started at offset 0, even though the NDP may be located later in the NTB via wNdpIndex/ndpoffset. That can let the descriptor array pass validation even when it extends beyond the skb data buffer. The follow-on iterator in cdc_ncm_rx_fixup() then reads beyond bounds. The resolved change includes ndpoffset in the nframes bounds check and switches to struct_size_t() for clarity.

Defensive priority

High for affected Linux kernels, particularly on systems where the cdc_ncm USB network path is in use and local attacker interaction is possible.

Recommended defensive actions

  • Apply the kernel updates that include the cdc_ncm bounds-check fix referenced in the linked stable patches.
  • Inventory affected Linux kernel versions and confirm exposure against the NVD version ranges.
  • Prioritize patching systems that use USB CDC NCM networking or that accept locally attached USB devices.
  • Monitor vendor advisories and kernel package updates tied to the referenced fixes.
  • If immediate patching is not possible, reduce exposure by limiting untrusted local access to affected systems.

Evidence notes

Based only on the supplied NVD record and linked kernel patches. The NVD record is marked analyzed, published on 2026-04-03 and modified on 2026-05-21. NVD lists CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8/High) and affected Linux kernel ranges ending at 6.6.130, 6.12.78, 6.18.20, 6.19.10, plus 7.0-rc1 through rc4. The record also cites CWE-129 and includes patch references in stable kernel git links.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-23448 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-23448

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-23448 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-23448

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/2aa8a4fa8d5b7d0e1ebcec100e1a4d80a1f4b21a

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/403f94ddcb36c552fbef51dea735b131e3dcde8b

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/789204f980730258c983102c027c375238009c80

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/dce9dda0e3707e887977db44407989e9ead26611

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/f1c7701d3ac91b62d672c13690cf295821f0d5c3

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.