CVE-2026-74679

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_ncm: Use unsigned int for ndp_index

The variable ndp_index is declared as a signed integer, but it stores

the return value of get_ncm(), which is unsigned.

A malicious host can supply a large offset that overflows the signed

ndp_index, making it negative. Because ndp_index is compared against

unsigned bounds, this negative value bypasses sanity checks and leads

to an out-of-bounds read when calculating the address of the NDP

block (ntb_ptr + ndp_index).

Fix this by changing ndp_index to unsigned int to ensure consistent

unsigned comparisons throughout the function.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References