CVE-2026-74679

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the usb gadget f ncm module where the ndp index variable is declared as a signed integer despite storing an unsigned return value from the get ncm() function. A malicious host can provide a large offset that causes ndp index to overflow and become negative. Since this variable is compared against unsigned bounds, the negative value bypasses sanity checks, resulting in an out-of-bounds read when calculating the address of the NDP block using ntb ptr + ndp index.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.