CVE-2026-23447

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-23447
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23447.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-23447
Downstream
BELL (1)
CLSA (2)
DEBIAN (1)
ECHO (1)
OESA (3)
openSUSE (1)
ROOT (5)
SUSE (10)
UBUNTU (1)
Related
openSUSE (1)
SUSE (10)
Published
2026-04-03T15:15:30Z
Modified
2026-10-08T02:50:39Z
Summary
net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check
Details

In the Linux kernel, the following vulnerability has been resolved:

net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check

The same bounds-check bug fixed for NDP16 in the previous patch also exists in cdc_ncm_rx_verify_ndp32(). The DPE array size is validated against the total skb length without accounting for ndpoffset, allowing out-of-bounds reads when the NDP32 is placed near the end of the NTB.

Add ndpoffset to the nframes bounds check and use struct_size_t() to express the NDP-plus-DPE-array size more clearly.

Compile-tested only.

Database specific 
{
    "cna_assigner":  "Linux",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23447.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
0fa81b304a7973a499f844176ca031109487dd31
Fixed
baf246d6680befde2086b1df9eb3aaba3fb6853f
Fixed
125f932a76a97904ef8a555f1dd53e5d0e288c54
Fixed
af0d1613d6751489dbf9f69aac1123f0b1e566e5
Fixed
a5bd5a2710310c965ea4153cba4210988a3454e2
Fixed
de70da1fb1d152e981ecb3157f7ec2b633005c16
Fixed
77914255155e68a20aa41175edeecf8121dac391
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
4.14.317
Fixed
4.15
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
4.19.285
Fixed
4.20
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
5.4.245
Fixed
5.5
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
8cf7db86a8984ffa3a3388a8df12bc0aa4c79bd7
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
4ca8b8855264cf1439cdab3da7049bd1e3c2a9e6
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
a270ca35a9499b58366d696d3290eaa4697a42db

Affected versions

v4.*
v4.14.317
v4.14.318
v4.14.319
v4.14.320
v4.14.321
v4.14.322
v4.14.323
v4.14.324
v4.14.325
v4.14.326
v4.14.327
v4.14.328
v4.14.329
v4.14.330
v4.14.331
v4.14.332
v4.14.333
v4.14.334
v4.14.335
v4.14.336
v4.19.285
v4.19.286
v4.19.287
v4.19.288
v4.19.289
v4.19.290
v4.19.291
v4.19.292
v4.19.293
v4.19.294
v4.19.295
v4.19.296
v4.19.297
v4.19.298
v4.19.299
v4.19.300
v4.19.301
v4.19.302
v4.19.303
v4.19.304
v4.19.305
v4.19.306
v4.19.307
v4.19.308
v4.19.309
v4.19.310
v4.19.311
v4.19.312
v4.19.313
v4.19.314
v4.19.315
v4.19.316
v4.19.317
v4.19.318
v4.19.319
v4.19.320
v4.19.321
v4.19.322
v4.19.323
v4.19.324
v4.19.325
v5.*
v5.4.245
v5.4.246
v5.4.247
v5.4.248
v5.4.249
v5.4.250
v5.4.251
v5.4.252
v5.4.253
v5.4.254
v5.4.255
v5.4.256
v5.4.257
v5.4.258
v5.4.259
v5.4.260
v5.4.261
v5.4.262
v5.4.263
v5.4.264
v5.4.265
v5.4.266
v5.4.267
v5.4.268
v5.4.269
v5.4.270
v5.4.271
v5.4.272
v5.4.273
v5.4.274
v5.4.275
v5.4.276
v5.4.277
v5.4.278
v5.4.279
v5.4.280
v5.4.281
v5.4.282
v5.4.283
v5.4.284
v5.4.285
v5.4.286
v5.4.287
v5.4.288
v5.4.289
v5.4.290
v5.4.291
v5.4.292
v5.4.293
v5.4.294
v5.4.295
v5.4.296
v5.4.297
v5.4.298
v5.4.299
v5.4.300
v5.4.301
v5.4.302

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23447.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.7.0
Fixed
6.1.188
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.130
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.78
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.20
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
6.19.10

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23447.json"