pico-usb-wifi

= pico-usb-wifi :toc: macro :toclevels: 3 :idprefix: :idseparator: - pico-usb-wifi es un firmware para la Raspberry Pi Pico W que la convierte en un adaptador USB Wi-Fi sin controlador, enumerándose como un dispositivo USB CDC-NCM. :figure-caption: Slop de IA .Diagrama de pico-usb-wifi...

The vulnerability of the cdc_ncm_rx_verify_ndp32() function in the drivers/net/usb/cdc_ncm.c module of the Linux kernel’s network adapter driver allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the cdcncmrxverifyndp32 function in the drivers/net/usb/cdcncm.c module of the Linux kernel’s network adapter driver is related to errors in calculating the data buffer size. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, a...

The vulnerability of the cdc_ncm_check_tx_max() function in the drivers/net/usb/cdc_ncm.c module of the Linux kernel’s USB network adapter driver allows a hacker to cause a service failure.

The vulnerability of the cdcncmchecktxmax function in the drivers/net/usb/cdcncm.c module of the Linux network adapter driver framework is related to a violation of the data format agreement. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-74679

A flaw was found in the Linux kernel's USB gadget NCM Network Control Model function fncm. A malicious host can exploit an integer overflow vulnerability by supplying a large offset. This overflow causes a signed index variable to become negative, bypassing security checks and leading to an...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fncm: fixed potential NULL pointer dereferencing in ncmbitrate In Google’s internal bug report 265639009, we received a crash report from a aarch64 GKI 5.10.149-android13 running device. This report is currently...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: CDC-NCM: Avoid overflows in sanity checks. A malfunctioning device may produce an extreme offset like 0xFFF0, along with a fragment of reasonable length. In the currently formulated sanity check, this will cause an integer...

Astra Linux – Vulnerabilities in Linux-6.1, Linux-5.15

In the Linux kernel, the following vulnerability has been resolved: USB: Gadget: fncm: Fixed UAF Use-After-Free in the ncm object after re-binding after a USB EP transport error When the ncm function is working, the usb0 interface is stopped due to a link failure. In this case, the ethstop functi...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs It is observed sometimes when tethering is used over NCM with Windows 11 as the host, that the gadgetgiveback function appends one byte to the end of a properly...

CVE-2026-68368

A flaw was found in the Linux kernel's USB gadget NCM Network Control Model driver. This vulnerability occurs because the driver fails to properly validate the boundaries of datagrams and Network Transfer Blocks NTBs supplied by a USB host. A malicious USB host can exploit this by crafting specif...

CVE-2026-12052

The USB device-side CDC NCM class control-to-host handler usbdcdcncmcth in subsys/usb/devicenext/class/usbdcdcncm.c builds a fixed-size response for the GETNTBPARAMETERS 28-byte struct ntbparameters and GETNTBINPUTSIZE 8-byte struct ntbinputsize class requests and copies the whole structure into...

EUVD-2026-55967

The USB device-side CDC NCM class control-to-host handler usbdcdcncmcth in subsys/usb/devicenext/class/usbdcdcncm.c builds a fixed-size response for the GETNTBPARAMETERS 28-byte struct ntbparameters and GETNTBINPUTSIZE 8-byte struct ntbinputsize class requests and copies the whole structure into...

CVE-2026-12052 Out-of-bounds write in USB CDC NCM control handler when host wLength is smaller than the response

The USB device-side CDC NCM class control-to-host handler usbdcdcncmcth in subsys/usb/devicenext/class/usbdcdcncm.c builds a fixed-size response for the GETNTBPARAMETERS 28-byte struct ntbparameters and GETNTBINPUTSIZE 8-byte struct ntbinputsize class requests and copies the whole structure into...

CVE-2026-12052 Out-of-bounds write in USB CDC NCM control handler when host wLength is smaller than the response

The USB device-side CDC NCM class control-to-host handler usbdcdcncmcth in subsys/usb/devicenext/class/usbdcdcncm.c builds a fixed-size response for the GETNTBPARAMETERS 28-byte struct ntbparameters and GETNTBINPUTSIZE 8-byte struct ntbinputsize class requests and copies the whole structure into...

CVE-2026-12052

The CVE-2026-12052 issue affects Zephyr’s USB device CDC NCM class (usbd_cdc_ncm_cth in subsys/usb/device_next/class/usbd_cdc_ncm.c). The handler builds fixed-size responses for GET_NTB_PARAMETERS (28-byte) and GET_NTB_INPUT_SIZE (8-byte) and copies the entire structure into the control DATA IN b...

PT-2026-70063

Name of the Vulnerable Software and Affected Versions Zephyr affected versions not specified Description An out-of-bounds write exists in the USB device-side CDC NCM class control-to-host handler usbd cdc ncm cth within the subsys/usb/device next/class/usbd cdc ncm.c file. The issue occurs when t...

UBUNTU-CVE-2026-68368

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fncm: validate datagram bounds in ncmunwrapntb When unpacking host-supplied NTBs, ncmunwrapntb checks datagram length against framemax but does not verify that the datagram fits within the declared block length...

CVE-2026-68368

The CVE concerns the Linux kernel USB gadget driver f_ncm (ncm_unwrap_ntb). The issue: when unpacking host-supplied NTBs, the code checked datagram length against frame_max but did not ensure the datagram fits within the declared block length, and subsequent NTBs from a single socket buffer were ...

CVE-2026-68368 usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb()

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fncm: validate datagram bounds in ncmunwrapntb When unpacking host-supplied NTBs, ncmunwrapntb checks datagram length against framemax but does not verify that the datagram fits within the declared block length...

Astra Linux - уязвимость в linux-5.10

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fncm: Fixed atomic context locking issue The ncmsetalt function was holding a mutex to prevent race conditions with configfs. This function invokes the mightsleep function within an atomic context. The struct pointer...

Linux Distros Unpatched Vulnerability : CVE-2026-43422

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: usb: legacy: ncm: Fix NPE in gncmbind Commit 56a512a9b410 usb: gadget: fncm: align netdevice...