CVE-2026-68368
Received Received - Intake

Buffer Overflow in Linux Kernel USB Gadget NCM Driver

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() When unpacking host-supplied NTBs, ncm_unwrap_ntb() checks datagram length against frame_max but does not verify that the datagram fits within the declared block length. Additionally, when decoding multiple NTBs from a single socket buffer, subsequent block lengths are not checked against the actual remaining buffer data. With these checks missing, a malicious USB host can specify datagram offsets and lengths that point beyond the block, or supply secondary NTB headers declaring lengths larger than the buffer. skb_put_data() then copies adjacent kernel memory from skb_shared_info into the network skb. Fix this by verifying that sufficient buffer space remains for the NTB header before parsing, handling zero-length block declarations, ensuring that block lengths never exceed the remaining buffer space, and verifying that each datagram payload stays strictly within the block boundary.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68368
EUVD
EUVD-2026-55469

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux_kernel linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a vulnerability in the Linux kernel's USB gadget function for NCM (Network Control Model). It allows a malicious USB host to craft network packets that trick the kernel into copying extra kernel memory into network buffers. The issue occurs when parsing network datagrams from USB data, where length checks are insufficient, enabling out-of-bounds memory access.

Detection Guidance

This vulnerability is specific to the Linux kernel's USB gadget NCM (Network Control Model) driver and requires access to the kernel source or logs. Detection involves checking kernel logs for related errors or monitoring USB gadget subsystem behavior. No standard network commands apply directly.

Impact Analysis

An attacker with physical USB access could exploit this to read sensitive kernel memory, potentially leaking passwords, encryption keys, or other secrets. It may also crash the system or enable further attacks by corrupting kernel memory.

Mitigation Strategies

Apply the latest kernel patch that fixes this issue. If patching is not immediately possible, disable the NCM USB gadget function (CONFIG_USB_ETH_NCM) in the kernel configuration to prevent exploitation. Monitor vendor advisories for updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68368. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart