CVE-2026-31617: Linux Kernel Privilege Escalation Flaw

CVE-2026-31617 Overview

CVE-2026-31617 is an integer underflow vulnerability in the Linux kernel USB gadget NCM (Network Control Model) function driver. The flaw resides in ncm_unwrap_ntb() within drivers/usb/gadget/function/f_ncm.c. A host-supplied block_len field in the NTB (NCM Transfer Block) header is validated against ntb_max but lacks a lower bound check. When block_len is smaller than opts->ndp_size, the subtraction block_len - opts->ndp_size underflows to a large unsigned value, neutralizing the subsequent bounds check on ndp_index. A malicious USB host can then craft offsets that cause skb_put_data() to copy adjacent kernel memory into the network socket buffer.

Critical Impact
A malicious USB host connected to a Linux device acting as a USB NCM gadget can trigger out-of-bounds kernel memory reads, leading to information disclosure or kernel memory corruption affecting system availability.

Affected Products

Linux Kernel (multiple stable branches, per fixes in commits 0f156bb5, 6762f8a9, 74908b03, 8757a259, 8f993d30, and d58ba8f6)
Systems exposing the USB NCM gadget function (g_ncm, ConfigFS-based gadgets using f_ncm)
Embedded and mobile Linux devices supporting USB device-mode networking

Discovery Timeline

2026-04-24 - CVE-2026-31617 published to NVD
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-31617

Vulnerability Analysis

The USB CDC NCM protocol exchanges data using NTBs that contain a header, one or more NDPs (NCM Datagram Pointers), and the datagrams themselves. The ncm_unwrap_ntb() function parses incoming NTBs received from the USB host and copies each datagram into a network sk_buff for delivery to the kernel networking stack.

The parser reads block_len from the host-controlled NTB header and confirms it does not exceed ntb_max. However, the code performs no minimum-size validation. When block_len is smaller than opts->ndp_size, the expression block_len - opts->ndp_size wraps around because both operands are unsigned. The resulting comparison ndp_index > (block_len - opts->ndp_size) becomes a comparison against a near-SIZE_MAX value that any plausible ndp_index will satisfy.

The identical defect occurs in the datagram offset check using block_len - opts->dpe_size. With both bounds checks defeated, the attacker controls ndp_index and per-datagram offsets that point well beyond the actual transfer buffer. The subsequent skb_put_data() call reads adjacent kernel memory into the transmitted skb, leaking kernel data to the network or corrupting skb internals.

Root Cause

The root cause is missing minimum-bound validation on attacker-controlled length fields, leading to unsigned integer underflow [CWE-191] during arithmetic on host-supplied values. The same class of issue was previously addressed on the host-side CDC-NCM driver in commit 8d2b1a1ec9f5 ("CDC-NCM: avoid overflow in sanity checking") but had not been mirrored to the gadget-side parser.

Attack Vector

Exploitation requires a malicious USB host (or a compromised USB peripheral acting as host) communicating with a Linux system configured to expose the NCM gadget function. The attacker sends a crafted NTB whose block_len field is set below ndp_size, then supplies arbitrary ndp_index and datagram offsets that point outside the legitimate transfer buffer. The kernel then copies out-of-bounds memory into network skbs, which may be returned to the attacker over the USB link or cause kernel state corruption.

The vulnerability is described in prose only. See the upstream patches linked under Kernel Git Commit 0f156bb and Kernel Git Commit d58ba8f for the exact source-level fix.

Detection Methods for CVE-2026-31617

Indicators of Compromise

Kernel log entries from the f_ncm driver reporting malformed NTB headers, oversized datagram counts, or skb allocation anomalies.
Unexpected USB gadget enumeration events on devices that should not be servicing untrusted USB hosts.
Crashes, oopses, or KASAN reports referencing ncm_unwrap_ntb or skb_put_data in stack traces.

Detection Strategies

Audit running kernels against the fix commits and flag any kernel build whose f_ncm.c lacks the minimum block_len validation.
Enable KASAN on test and pre-production kernels to surface out-of-bounds reads in ncm_unwrap_ntb() during USB fuzzing.
Correlate dmesg USB gadget warnings with physical-access events to identify suspicious connection patterns.

Monitoring Recommendations

Track kernel version inventory and patch state across Linux fleets, including embedded and IoT devices that ship USB gadget functions.
Monitor USB device connection events on Linux endpoints using udev logs and auditd rules.
Forward kernel ring buffer messages to a centralized logging pipeline for anomaly review.

How to Mitigate CVE-2026-31617

Immediate Actions Required

Apply the upstream stable kernel updates that include the ncm_unwrap_ntb() minimum-length check from the commits listed in the vendor advisories.
Restrict physical access to systems exposing USB device-mode networking, particularly kiosks, lab equipment, and embedded gateways.
Disable the NCM gadget function on devices that do not require USB-tethered networking.

Patch Information

The fix rejects block_len values that cannot hold at least the NTB header plus one NDP, ensuring that both block_len - opts->ndp_size and block_len - opts->dpe_size are well-defined. Patches are available across stable branches:

Workarounds

Unload the usb_f_ncm module on systems that do not need NCM gadget functionality: modprobe -r usb_f_ncm.
Remove or disable ConfigFS gadget configurations that bind the ncm.* function.
Enforce USB port lockdown policies (USBGuard or equivalent) to block untrusted host connections to Linux devices operating in gadget mode.

bash

# Configuration example: disable the NCM gadget function and blacklist the module
sudo modprobe -r usb_f_ncm
echo 'blacklist usb_f_ncm' | sudo tee /etc/modprobe.d/disable-ncm.conf
sudo update-initramfs -u