SB20260425107 - Integer underflow in Linux kernel gadget function driver

Description

This security bulletin contains information about 1 vulnerability.

1) Integer underflow (CVE-ID: CVE-2026-31617)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows an attacker with physical access to disclose sensitive information.

The vulnerability exists due to an integer underflow in ncm_unwrap_ntb() in the f_ncm USB gadget component when processing a host-supplied NTB header. An attacker with physical access can provide a crafted NTB header with a too-small block length and out-of-bounds indexes to disclose sensitive information.

The issue can cause adjacent kernel memory to be copied into a network skb.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/6762f8a95772265dd0c2ffe7f400493f3115b135
• https://git.kernel.org/stable/c/74908b0318d1df1188457040b8714ff4d4b68126
• https://git.kernel.org/stable/c/8757a2593631443648218244b9788e193ae0fdc1
• https://git.kernel.org/stable/c/d58ba8f6546232f8414f396c189297dbee03f1a7