CVE-2026-23447: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-23447 Overview

CVE-2026-23447 is an out-of-bounds read vulnerability in the Linux kernel's cdc_ncm USB networking driver. The flaw resides in the cdc_ncm_rx_verify_ndp32() function, which fails to account for ndpoffset when validating the size of the NDP32 frames array against the total skb length. When the NCM Datagram Pointer (NDP32) header is placed near the end of the NCM Transfer Block (NTB), a malicious or malformed USB device can trigger reads beyond the allocated buffer. This issue mirrors a previously patched NDP16 bug in the same driver and is categorized under [CWE-129] Improper Validation of Array Index.

Critical Impact
Local attackers with the ability to connect a crafted USB CDC NCM device can trigger out-of-bounds memory reads in the kernel, leading to information disclosure or denial of service.

Affected Products

Linux Kernel (multiple stable branches prior to fix commits)
Linux Kernel 5.7
Linux Kernel 7.0 release candidates (rc1 through rc7)

Discovery Timeline

2026-04-03 - CVE-2026-23447 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2026-23447

Vulnerability Analysis

The cdc_ncm driver implements support for USB Communications Device Class Network Control Model devices. It parses NCM Transfer Blocks (NTBs) which contain NCM Datagram Pointer (NDP) structures describing the datagrams within each transfer. The 32-bit variant uses cdc_ncm_rx_verify_ndp32() to validate the structure before processing.

The verification routine checks whether the NDP plus its array of Datagram Pointer Entries (DPEs) fits within the socket buffer (skb). However, the check compares the size of the NDP and DPE array against the total skb->len without adding ndpoffset, which is the offset where the NDP starts inside the NTB.

When ndpoffset is large, meaning the NDP is positioned near the end of the NTB, the calculated end of the DPE array can extend past the buffer boundary. The driver then reads DPE entries from memory beyond the allocated skb. Exploitation does not require elevated privileges beyond physical or local USB access, and the impact spans confidentiality, integrity, and availability.

Root Cause

The root cause is an arithmetic error in a bounds check. The validation expression omits the base offset ndpoffset when computing whether the NDP plus DPE array fits within the skb. The fix adds ndpoffset to the comparison and uses struct_size_t() to express the NDP-plus-DPE-array size more clearly.

Attack Vector

An attacker with local access can plug in a malicious USB device that advertises itself as a CDC NCM network adapter. By crafting NTBs with an NDP32 header placed near the end of the buffer, the attacker forces the kernel to read past the allocated skb boundary. The resulting memory disclosure or kernel crash provides a foothold for further privilege escalation or denial of service.

The vulnerability is described in prose only; refer to the Kernel Git Commit #af0d16 for the verified upstream patch.

Detection Methods for CVE-2026-23447

Indicators of Compromise

Unexpected kernel log entries referencing cdc_ncm, cdc_ncm_rx_verify_ndp32, or NTB parsing errors
KASAN or slab-out-of-bounds reports tied to the USB CDC NCM driver
Sudden kernel oopses or panics following the connection of an unknown USB network adapter

Detection Strategies

Monitor dmesg and journalctl -k output for warnings emitted by the cdc_ncm driver during USB enumeration
Enable KASAN on test or canary systems to surface out-of-bounds reads in the networking USB stack
Track USB device connection events through udev and correlate with kernel error bursts

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM platform and alert on cdc_ncm parser failures
Inventory hosts running affected Linux kernel versions and prioritize systems exposing physical USB ports in shared environments
Restrict USB device classes via usbguard policies and alert when new CDC NCM devices are attached

How to Mitigate CVE-2026-23447

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by the stable tree commits as soon as distribution updates are available
Disable or unload the cdc_ncm module on systems that do not require USB NCM networking using modprobe -r cdc_ncm
Enforce USB device access policies on multi-user systems, kiosks, and servers exposed to untrusted physical access

Patch Information

The fix adds ndpoffset to the nframes bounds check inside cdc_ncm_rx_verify_ndp32() and uses struct_size_t() for clearer size computation. The patch is available in the following stable kernel commits: Kernel Git Commit #125f932, Kernel Git Commit #779142, Kernel Git Commit #a5bd5a, Kernel Git Commit #af0d16, and Kernel Git Commit #de70da.

Workarounds

Blacklist the cdc_ncm module via /etc/modprobe.d/ if USB NCM networking is not in use
Deploy usbguard or equivalent USB allow-listing to block unknown CDC NCM class devices
Physically restrict access to USB ports on production servers and shared workstations

bash

# Blacklist the cdc_ncm module on systems that do not need it
echo "blacklist cdc_ncm" | sudo tee /etc/modprobe.d/blacklist-cdc_ncm.conf
sudo modprobe -r cdc_ncm

# Verify the module is no longer loaded
lsmod | grep cdc_ncm