CVE-2026-31617

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw exists in the USB Network Control Model (NCM) gadget driver. An integer underflow occurs in the ncm unwrap ntb() function when processing Network Transfer Block (NTB) headers because the block len variable lacks a lower bound check. If block len is smaller than opts->ndp size or opts->dpe size, the resulting bounds check underflows, creating a large unsigned value that bypasses security validations. A malicious USB host can exploit this to manipulate ndp index and datagram offsets to point beyond the actual transfer, causing the skb put data() function to copy adjacent kernel memory into network buffers, leading to kernel information disclosure.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.