CVE-2026-74679: Linux Kernel f_ncm Privilege Escalation

CVE-2026-74679 Overview

CVE-2026-74679 is an out-of-bounds read vulnerability in the Linux kernel's USB gadget f_ncm driver. The flaw resides in the Network Control Model (NCM) function handler, where the ndp_index variable is declared as a signed integer but stores an unsigned return value from get_ncm(). A malicious USB host can supply a large offset that overflows the signed ndp_index, producing a negative value. Because subsequent sanity checks compare ndp_index against unsigned bounds, the negative value bypasses validation and leads to an out-of-bounds read at ntb_ptr + ndp_index.

Critical Impact
A malicious USB host can trigger an out-of-bounds kernel memory read on Linux devices exposing a USB NCM gadget interface, enabling information disclosure or kernel instability.

Affected Products

Linux kernel USB gadget subsystem (drivers/usb/gadget/function/f_ncm.c)
Linux distributions shipping vulnerable stable kernel branches prior to the referenced fix commits
Embedded and mobile devices exposing USB NCM (Ethernet-over-USB) gadget functionality

Discovery Timeline

2026-08-22 - CVE-2026-74679 published to NVD
2026-08-22 - Last updated in NVD database

Technical Details for CVE-2026-74679

Vulnerability Analysis

The vulnerability affects the USB gadget NCM function, which implements the USB Network Control Model protocol for Ethernet-over-USB connectivity. The f_ncm driver parses NCM Transfer Blocks (NTBs) received from a USB host and locates the NCM Datagram Pointer (NDP) block within them using an offset stored in ndp_index.

The root defect is a type mismatch: ndp_index is declared as a signed int, but the offset returned by get_ncm() is an unsigned value that can span the full 32-bit range. Downstream validation compares ndp_index against unsigned upper bounds, which incorrectly accepts negative values as legitimately small.

When the driver then computes ntb_ptr + ndp_index to locate the NDP header, the negative offset causes the pointer arithmetic to reference memory outside the received transfer buffer. This constitutes an out-of-bounds read [CWE-125] in kernel address space, potentially leaking adjacent kernel heap contents or destabilizing the gadget subsystem.

Root Cause

The root cause is inconsistent integer signedness between the producer and consumer of ndp_index. The unsigned value returned by get_ncm() is stored in a signed variable, silently reinterpreting large offsets as negative. The subsequent unsigned bounds check (ndp_index < ntb_max) treats the sign-extended negative operand as a very large unsigned value or bypasses the check entirely depending on comparison semantics, allowing invalid offsets to reach pointer arithmetic. The upstream fix declares ndp_index as unsigned int so all comparisons remain unsigned and consistent.

Attack Vector

Exploitation requires the target Linux system to be operating as a USB device (gadget mode) with the NCM function enabled and physically connected to an attacker-controlled USB host. The malicious host crafts an NCM Transfer Block containing a wNdpIndex field large enough to overflow the signed ndp_index when parsed. When the gadget driver processes the malformed NTB, the negative offset bypasses sanity checks and triggers the out-of-bounds read. The vulnerability is reachable without authentication over the USB transport, making USB-facing embedded devices, phones, and single-board computers the primary risk surface. No verified public proof-of-concept exploit code has been published at this time; refer to the upstream kernel commits for the patch diff and technical details.

Detection Methods for CVE-2026-74679

Indicators of Compromise

Kernel log entries referencing f_ncm, ncm_unwrap_ntb, or NTB parsing errors coinciding with USB device attachment events
Unexpected kernel oops, warnings, or KASAN reports in the USB gadget subsystem after connection to an untrusted host
Repeated USB reconnection or reset events from a single host paired with malformed NCM traffic

Detection Strategies

Compare running kernel versions against the fixed stable branches referenced in the Kernel Git Commit 6b1c8a9 and related patch set
Enable KASAN (Kernel Address Sanitizer) in test and lab environments to surface out-of-bounds reads in the f_ncm code path
Audit device fleets for gadget-mode Linux systems exposing the NCM function via ConfigFS

Monitoring Recommendations

Forward kernel logs (dmesg, journald) from Linux endpoints and embedded devices to a centralized data lake for correlation of USB-related anomalies
Alert on kernel oops, WARN_ON, or KASAN traces originating in drivers/usb/gadget/function/f_ncm.c
Track USB device attach/detach telemetry on high-value hosts to identify unauthorized peripherals connecting to gadget-mode systems

How to Mitigate CVE-2026-74679

Immediate Actions Required

Update affected Linux systems to a kernel version that includes the ndp_index type fix from the referenced stable commits
Inventory all devices operating in USB gadget mode with the NCM function enabled and prioritize patching
Restrict physical USB access to trusted hosts on devices that cannot be immediately updated

Patch Information

The fix changes the type of ndp_index from signed int to unsigned int in drivers/usb/gadget/function/f_ncm.c, ensuring consistent unsigned comparisons and blocking the sign-overflow bypass. The patch has been applied across multiple stable branches. Relevant upstream commits include Kernel Git Commit 11413d7, Kernel Git Commit 5b2b3a3, Kernel Git Commit 6b1c8a9, Kernel Git Commit 9c8c682, Kernel Git Commit a1c0deb, Kernel Git Commit d13f650, Kernel Git Commit d328fdc, and Kernel Git Commit fc9e54e.

Workarounds

Disable the NCM gadget function in ConfigFS on devices where Ethernet-over-USB is not required
Unload the usb_f_ncm module on systems that do not need NCM functionality
Enforce physical port controls and cable-lock policies on portable devices exposing gadget interfaces to reduce exposure to malicious USB hosts