CVE-2026-74679 usb: gadget: f_ncm: Use unsigned int for ndp_index

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fncm: Use unsigned int for ndpindex The variable ndpindex is declared as a signed integer, but it stores the return value of getncm, which is unsigned. A malicious host can supply a large offset that overflows the...

CVE-2026-74679 usb: gadget: f_ncm: Use unsigned int for ndp_index

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fncm: Use unsigned int for ndpindex The variable ndpindex is declared as a signed integer, but it stores the return value of getncm, which is unsigned. A malicious host can supply a large offset that overflows the...

EUVD-2026-64366

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fncm: Use unsigned int for ndpindex The variable ndpindex is declared as a signed integer, but it stores the return value of getncm, which is unsigned. A malicious host can supply a large offset that overflows the...

PT-2026-79684

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f ncm: Use unsigned int for ndp index The variable ndp index is declared as a signed integer, but it stores the return value of get ncm, which is unsigned. A malicious host can supply a large offset that overflows th...

Linux Distros Unpatched Vulnerability : CVE-2026-74679

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: gadget: fncm: Use unsigned int for ndpindex The variable ndpindex is declared as a signed integer, but it stores the return value of getncm, which is...

SUSE CVE-2026-68368

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fncm: validate datagram bounds in ncmunwrapntb When unpacking host-supplied NTBs, ncmunwrapntb checks datagram length against framemax but does not verify that the datagram fits within the declared block length...

SUSE CVE-2026-68369

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: printer: fix infinite loop in printerread printerread uses the same variable for the requested copy size and the number of bytes actually copied to user space. copytouser returns the number of bytes not copied, so wh...

The vulnerability of the functions __cdnsp_gadget_init() and cdnsp_gadget_exit() in the kernel module drivers/usb/cdns3/cdnsp-gadget.c of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the functions cdnspgadgetinit and cdnspgadgetexit in the kernel module drivers/usb/cdns3/cdnsp-gadget.c of the Linux operating system is related to memory initialization errors. Exploiting this vulnerability could allow an attacker to cause a service failure...

Linux Distros Unpatched Vulnerability : CVE-2026-68088

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: gadget: function: rndis: add length check to response query Add variable representations for BufLength and BufOffset in rndisqueryresponse, and perform a...

SUSE CVE-2026-68088

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check to response query Add variable representations for BufLength and BufOffset in rndisqueryresponse, and perform a length check on them. This is identical to how rndissetresponse handle...

CVE-2026-68369

A flaw was found in the Linux kernel's USB gadget printer driver. An attacker, by providing specific input to the printerread function, could trigger an infinite loop. This vulnerability occurs when the copytouser function fails to copy data, leading to a denial of service condition where the...

CVE-2026-68368

A flaw was found in the Linux kernel's USB gadget NCM Network Control Model driver. This vulnerability occurs because the driver fails to properly validate the boundaries of datagrams and Network Transfer Blocks NTBs supplied by a USB host. A malicious USB host can exploit this by crafting specif...

CVE-2026-68367

A flaw was found in the Linux kernel's USB gadget function ftcm. A local attacker could exploit a race condition during the teardown of a USB gadget function. This could lead to a use-after-free vulnerability, potentially causing a system crash denial of service or, in more severe cases, arbitrar...

CVE-2026-68370

A flaw was found in the Linux kernel's USB gadget dummy Host Controller Driver HCD. A race condition can occur when a shared USB request object fiforeq is prematurely reused before its completion callback has finished. This can lead to the overwriting of the callback pointer, causing a general...

usb: gadget: function: rndis: add length check to response query

...

CVE-2026-68369

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: printer: fix infinite loop in printerread printerread uses the same variable for the requested copy size and the number of bytes actually copied to user space. copytouser returns the number of bytes not copied, so wh...

CVE-2026-68366

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: clamp SENDRESPONSE length to the response buffer uvcsendresponse builds the UVC control response from a user-supplied struct uvcrequestdata: req-length = mintunsigned int, uvc-eventlength, data-length;...

DEBIAN-CVE-2026-68367

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ftcm: synchronize delayed setalt with teardown The ftcm setalt path defers endpoint setup to a work item and completes the delayed status response from process context. The delayed work uses ftcm private state and ma...

CVE-2026-68367

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ftcm: synchronize delayed setalt with teardown The ftcm setalt path defers endpoint setup to a work item and completes the delayed status response from process context. The delayed work uses ftcm private state and ma...

CVE-2026-68368

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fncm: validate datagram bounds in ncmunwrapntb When unpacking host-supplied NTBs, ncmunwrapntb checks datagram length against framemax but does not verify that the datagram fits within the declared block length...