Not yet scoredPublished Aug 22, 2026

CVE-2026-74679usb: gadget: f_ncm: Use unsigned int for ndp_index

Updated under an hour ago (Oct 26, 2026, 1:40 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_ncm: Use unsigned int for ndp_index The variable ndp_index is declared as a signed integer, but it stores the return value of get_ncm(), which is unsigned. A malicious host can supply a large offset that overflows the signed ndp_index, making it negative. Because ndp_index is compared against unsigned bounds, this negative value bypasses sanity checks and leads to an out-of-bounds read when calculating the address of the NDP block (ntb_ptr + ndp_index). Fix this by changing ndp_index to unsigned int to ensure consistent unsigned comparisons throughout the function.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Aug 22, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	370af734dfaf8336b496b386e194648e097e248a builds before 9c8c6825a750fcd3efbe922847ca70ccd5a66857; from 370af734dfaf8336b496b386e194648e097e248a before a1c0deeba4a46481543d6b09c665f758c54c3a1a; from 370af734dfaf8336b496b386e194648e097e248a before d13f650a3485b58c124b3cda45597e8002c9c833; from 370af734dfaf8336b496b386e194648e097e248a before 11413d7ed42174b8f5d8d0b6a25d10dc88239b21; 370af734dfaf8336b496b386e194648e097e248a builds before 5b2b3a3229a3f4c493ffdee53aee2f173b6f13b3; from 370af734dfaf8336b496b386e194648e097e248a before d328fdc607fa1bb668ad512e1c918a120f78f337; from 370af734dfaf8336b496b386e194648e097e248a before fc9e54e22845c4da29588ca0986cb7c795b5a262; 370af734dfaf8336b496b386e194648e097e248a builds before 6b1c8a9403a26cb0fed7a648916c74dc236da591	CNA record

References

References

https://git.kernel.org/stable/c/9c8c6825a750fcd3efbe922847ca70ccd5a66857
https://git.kernel.org/stable/c/a1c0deeba4a46481543d6b09c665f758c54c3a1a
https://git.kernel.org/stable/c/d13f650a3485b58c124b3cda45597e8002c9c833
https://git.kernel.org/stable/c/11413d7ed42174b8f5d8d0b6a25d10dc88239b21
https://git.kernel.org/stable/c/5b2b3a3229a3f4c493ffdee53aee2f173b6f13b3
https://git.kernel.org/stable/c/d328fdc607fa1bb668ad512e1c918a120f78f337
https://git.kernel.org/stable/c/fc9e54e22845c4da29588ca0986cb7c795b5a262
https://git.kernel.org/stable/c/6b1c8a9403a26cb0fed7a648916c74dc236da591

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.