CVE-2026-68368 Overview
CVE-2026-68368 is an out-of-bounds read vulnerability in the Linux kernel's USB gadget f_ncm driver. The flaw resides in ncm_unwrap_ntb(), which parses NCM Transfer Blocks (NTBs) supplied by a USB host. The function validates datagram length against frame_max but fails to confirm that datagrams fit within the declared block length. When multiple NTBs are decoded from a single socket buffer, subsequent block lengths are not bounded against the remaining buffer data. A malicious USB host can craft NTB headers that force skb_put_data() to copy adjacent kernel memory from skb_shared_info into a network skb, leaking kernel data across the USB interface.
Critical Impact
A malicious USB host can trigger out-of-bounds reads in the Linux kernel's NCM gadget driver, exposing adjacent kernel memory to the attacker over the USB link.
Affected Products
- Linux kernel USB gadget subsystem — drivers/usb/gadget/function/f_ncm.c
- Devices operating in USB gadget mode using the NCM (Network Control Model) function
- Multiple stable kernel branches referenced by upstream fix commits
Discovery Timeline
- 2026-08-10 - CVE-2026-68368 published to NVD
- 2026-08-10 - Last updated in NVD database
Technical Details for CVE-2026-68368
Vulnerability Analysis
The USB NCM gadget function reassembles Ethernet frames from NTBs received from the host. ncm_unwrap_ntb() iterates over datagram pointers embedded in each NTB and copies the referenced payload into a socket buffer for delivery to the network stack. The routine confirms that individual datagram lengths do not exceed frame_max, but it never confirms that the datagram offset plus length remains within the block declared by the NTB header. It also trusts secondary NTB headers when walking multiple NTBs inside a single socket buffer, without re-validating their declared lengths against the buffer that remains.
Because the datagram offset and length fields originate from an untrusted USB host, an attacker controlling the peer can point them beyond the block boundary or declare a block larger than the buffer holds. skb_put_data() then reads past valid data and copies adjacent kernel memory, including bytes from skb_shared_info, into the outbound skb. That memory can subsequently be observed on the network side of the gadget.
Root Cause
The root cause is missing input validation on host-supplied length and offset fields when parsing NTB headers. The parser does not verify that sufficient buffer space remains for an NTB header before dereferencing it, does not handle zero-length block declarations, and does not enforce that block lengths and datagram payload extents stay within the remaining buffer. This is an out-of-bounds read leading to kernel information disclosure.
Attack Vector
Exploitation requires an attacker-controlled USB host connected to a Linux device operating as a USB gadget with the NCM function enabled. The attacker sends malformed NTBs whose datagram offsets, datagram lengths, or secondary block lengths reference memory outside the receive buffer. The kernel copies out-of-bounds bytes into an skb that is then delivered across the emulated network interface, exposing kernel memory contents to the peer.
No verified public exploit code is available. See the upstream kernel commits linked under references for the corrective patches and the exact validation logic added to ncm_unwrap_ntb().
Detection Methods for CVE-2026-68368
Indicators of Compromise
- Unusual NCM traffic patterns on USB gadget interfaces, particularly frames whose payloads contain non-Ethernet, kernel-shaped byte sequences.
- Kernel log entries or crashes originating in ncm_unwrap_ntb() or the f_ncm module under sustained USB activity.
- USB hosts issuing NTBs with block lengths or datagram offsets that exceed transferred buffer sizes.
Detection Strategies
- Inventory Linux systems that expose USB gadget functionality with NCM enabled, such as embedded devices, single-board computers, and mobile tethering endpoints.
- Compare running kernel versions against the fix commits 1febec7e, 40c706a, 41fd5f2f, e07751d, and fff1059d to confirm patch application.
- Review kernel configuration for CONFIG_USB_CONFIGFS_NCM and CONFIG_USB_F_NCM to identify systems where the vulnerable code path is reachable.
Monitoring Recommendations
- Alert on kernel oops or WARN traces referencing f_ncm, ncm_unwrap_ntb, or skb_put_data on gadget-capable hosts.
- Restrict physical USB access to sensitive Linux devices and log peripheral connections to detect untrusted hosts.
- Track vendor and distribution advisories mapped to CVE-2026-68368 for backported fixes to long-term support kernels.
How to Mitigate CVE-2026-68368
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the fix commits to any kernel building the NCM gadget function.
- Disable the NCM gadget function on devices where USB networking to arbitrary hosts is not required.
- Enforce physical control over USB ports on affected devices until patched kernels are deployed.
Patch Information
The fix adds explicit bounds checks in ncm_unwrap_ntb(): it verifies that sufficient buffer space remains for the NTB header before parsing, rejects zero-length block declarations, ensures block lengths never exceed the remaining buffer, and validates that each datagram payload stays strictly within the block boundary. The corrective changes are landed in the following commits: Kernel Git Commit 1febec7e, Kernel Git Commit 40c706a, Kernel Git Commit 41fd5f2f, Kernel Git Commit e07751d, and Kernel Git Commit fff1059d.
Workarounds
- Unload or blacklist the usb_f_ncm module on systems that do not require NCM gadget functionality.
- Remove NCM from active USB gadget configurations exposed through configfs and use an alternate function such as ECM or RNDIS where feasible.
- Limit USB gadget devices to trusted hosts only, especially in kiosks, embedded appliances, and lab equipment.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
