68 matches found
Siemens SIMATIC S7-1500 TM MFP Integer Underflow (CVE-2026-31617)
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fncm: validate minimum blocklen in ncmunwrapntb The blocklen read from the host-supplied NTB header is checked against ntbmax but has no lower bound. When blocklen is smaller than opts-ndpsize, the bounds check of:...
Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-43421)
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fncm: Fix netdevice lifecycle with devicemove The network device outlived its parent gadget device during disconnection, resulting in dangling sysfs links and null pointer dereference problems. A prior attempt to sol...
Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fncm: Refactor the bind path to use free After a bind/unbind cycle, the ncm-notifyreq remains stale. If a subsequent bind fails, the unified error handling mechanism attempts to free this stale request. This leads to...
Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098970)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098970 advisory. In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fncm: Refactor bind path to use free After an bind/unbind cycle, the ncm-notifyreq i...
CVE-2026-74679
A flaw was found in the Linux kernel's USB gadget NCM Network Control Model function fncm. A malicious host can exploit an integer overflow vulnerability by supplying a large offset. This overflow causes a signed index variable to become negative, bypassing security checks and leading to an...
SUSE CVE-2026-74679
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fncm: Use unsigned int for ndpindex The variable ndpindex is declared as a signed integer, but it stores the return value of getncm, which is unsigned. A malicious host can supply a large offset that overflows the...
CVE-2026-74679
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fncm: Use unsigned int for ndpindex The variable ndpindex is declared as a signed integer, but it stores the return value of getncm, which is unsigned. A malicious host can supply a large offset that overflows the...
CVE-2026-74679
CVE-2026-74679 affects the Linux kernel USB gadget NCM function (f_ncm). The variable ndp_index is declared as a signed integer but stores the unsigned return value of get_ncm(). A malicious host can supply a large offset that overflows the signed ndp_index, making it negative. Because the value ...
CVE-2026-74679 usb: gadget: f_ncm: Use unsigned int for ndp_index
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fncm: Use unsigned int for ndpindex The variable ndpindex is declared as a signed integer, but it stores the return value of getncm, which is unsigned. A malicious host can supply a large offset that overflows the...
EUVD-2026-64366
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fncm: Use unsigned int for ndpindex The variable ndpindex is declared as a signed integer, but it stores the return value of getncm, which is unsigned. A malicious host can supply a large offset that overflows the...
CVE-2026-74679 usb: gadget: f_ncm: Use unsigned int for ndp_index
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fncm: Use unsigned int for ndpindex The variable ndpindex is declared as a signed integer, but it stores the return value of getncm, which is unsigned. A malicious host can supply a large offset that overflows the...
PT-2026-79684
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the usb gadget f ncm module where the ndp index variable is declared as a signed integer despite storing an unsigned return value from the get ncm function. A maliciou...
CVE-2026-74679: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fncm: Use unsigned int for ndpindex The variable ndpindex is declared as a signed integer, but it stores the return value of getncm, which is unsigned. A malicious host can supply a large offset that overflows the...
Linux Distros Unpatched Vulnerability : CVE-2026-74679
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: gadget: fncm: Use unsigned int for ndpindex The variable ndpindex is declared as a signed integer, but it stores the return value of getncm, which is...
usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb()
...
CVE-2026-68368
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fncm: validate datagram bounds in ncmunwrapntb When unpacking host-supplied NTBs, ncmunwrapntb checks datagram length against framemax but does not verify that the datagram fits within the declared block length...
CVE-2026-68368: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fncm: validate datagram bounds in ncmunwrapntb When unpacking host-supplied NTBs, ncmunwrapntb checks datagram length against framemax but does not verify that the datagram fits within the declared block length...
PT-2026-69768
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the f ncm USB gadget driver where the ncm unwrap ntb function fails to properly validate datagram bounds when unpacking host-supplied Network Control Model NCM packets...
SUSE CVE-2026-43421
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fncm: Fix netdevice lifecycle with devicemove The network device outlived its parent gadget device during disconnection, resulting in dangling sysfs links and null pointer dereference problems. A prior attempt to sol...