---
id: CVE-2026-68368
title: 'usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb()

  When unpacking host-supplied NTBs, ncm_unwrap_ntb() checks datagram length
  against frame_max but does …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 2b74b0a04d3e9f9f08ff026e5663dce88ff94e52 <
    35d15bbaec0557330e774ec31412ef508de6e0e0
  - >-
    Linux >= 2b74b0a04d3e9f9f08ff026e5663dce88ff94e52 <
    6b2be489eaa6293e60549005d91f15ceb150510f
  - >-
    Linux >= 2b74b0a04d3e9f9f08ff026e5663dce88ff94e52 <
    f87ed889f0f7417b8938c98d8833f559b755373c
  - >-
    Linux >= 2b74b0a04d3e9f9f08ff026e5663dce88ff94e52 <
    e07751d0527ccc2a1c32eb0b0b7da3b4b9b5381f
  - >-
    Linux >= 2b74b0a04d3e9f9f08ff026e5663dce88ff94e52 <
    fff1059d139ef798bab917990524faaf25854ca8
  - >-
    Linux >= 2b74b0a04d3e9f9f08ff026e5663dce88ff94e52 <
    40c706a0224bde194667e3378c689b542fec4b44
  - >-
    Linux >= 2b74b0a04d3e9f9f08ff026e5663dce88ff94e52 <
    41fd5f2fb0027d3773ae949e3247c2e0a2a7fe5c
  - >-
    Linux >= 2b74b0a04d3e9f9f08ff026e5663dce88ff94e52 <
    1febec7e47cdcd01f43fb0211094e3010474666e
  - Linux f7e0611e207d8908c4f2858e244370529a76dbf7
  - Linux b88ad6e714284b33a47834f5f2a294c2b37c66aa
  - Linux 471b23586387a32857778c511be60ab31c98dcfd
  - Linux 4f529c4d1e436230d3af7c09a3239677a14d2b46
  - Linux ae6a5394d9fbe118bc95cfe376d6a9d91d7547e8
  - Linux 5bdf93a2f5459f944b416b188178ca4a92fd206f
  - Linux ff3ba016263ee93a1c6209bf5ab1599de7ab1512
  - Linux e7ca00f35d8a17af1ae19d529193ebc21bfda164
  - Linux >= 4.9.235 < 4.10
  - Linux >= 4.14.196 < 4.15
  - Linux >= 4.19.143 < 4.20
  - Linux >= 5.4.62 < 5.5
  - Linux >= 5.8.6 < 5.9
  - Linux >= 4.14.328 < 4.15
  - Linux >= 4.19.297 < 4.20
  - Linux >= 5.4.259 < 5.5
  - Linux 5.9
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:48:23.014514Z'
published: '2026-08-10'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:55:14.928Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-68368'
references:
  - url: 'https://git.kernel.org/stable/c/35d15bbaec0557330e774ec31412ef508de6e0e0'
  - url: 'https://git.kernel.org/stable/c/6b2be489eaa6293e60549005d91f15ceb150510f'
  - url: 'https://git.kernel.org/stable/c/f87ed889f0f7417b8938c98d8833f559b755373c'
  - url: 'https://git.kernel.org/stable/c/e07751d0527ccc2a1c32eb0b0b7da3b4b9b5381f'
  - url: 'https://git.kernel.org/stable/c/fff1059d139ef798bab917990524faaf25854ca8'
  - url: 'https://git.kernel.org/stable/c/40c706a0224bde194667e3378c689b542fec4b44'
  - url: 'https://git.kernel.org/stable/c/41fd5f2fb0027d3773ae949e3247c2e0a2a7fe5c'
  - url: 'https://git.kernel.org/stable/c/1febec7e47cdcd01f43fb0211094e3010474666e'
tags:
  - cve.org
epss: 0.00216
epssPercentile: 0.12154
ingestedAt: '2026-11-06T18:00:12.606Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb()

When unpacking host-supplied NTBs, ncm_unwrap_ntb() checks datagram length
against frame_max but does not verify that the datagram fits within the
declared block length. Additionally, when decoding multiple NTBs from a
single socket buffer, subsequent block lengths are not checked against the
actual remaining buffer data.

With these checks missing, a malicious USB host can specify datagram
offsets and lengths that point beyond the block, or supply secondary NTB
headers declaring lengths larger than the buffer. skb_put_data() then
copies adjacent kernel memory from skb_shared_info into the network skb.

Fix this by verifying that sufficient buffer space remains for the NTB
header before parsing, handling zero-length block declarations, ensuring
that block lengths never exceed the remaining buffer space, and verifying
that each datagram payload stays strictly within the block boundary.

## Affected

- `Linux >= 2b74b0a04d3e9f9f08ff026e5663dce88ff94e52 < 35d15bbaec0557330e774ec31412ef508de6e0e0`
- `Linux >= 2b74b0a04d3e9f9f08ff026e5663dce88ff94e52 < 6b2be489eaa6293e60549005d91f15ceb150510f`
- `Linux >= 2b74b0a04d3e9f9f08ff026e5663dce88ff94e52 < f87ed889f0f7417b8938c98d8833f559b755373c`
- `Linux >= 2b74b0a04d3e9f9f08ff026e5663dce88ff94e52 < e07751d0527ccc2a1c32eb0b0b7da3b4b9b5381f`
- `Linux >= 2b74b0a04d3e9f9f08ff026e5663dce88ff94e52 < fff1059d139ef798bab917990524faaf25854ca8`
- `Linux >= 2b74b0a04d3e9f9f08ff026e5663dce88ff94e52 < 40c706a0224bde194667e3378c689b542fec4b44`
- `Linux >= 2b74b0a04d3e9f9f08ff026e5663dce88ff94e52 < 41fd5f2fb0027d3773ae949e3247c2e0a2a7fe5c`
- `Linux >= 2b74b0a04d3e9f9f08ff026e5663dce88ff94e52 < 1febec7e47cdcd01f43fb0211094e3010474666e`
- `Linux f7e0611e207d8908c4f2858e244370529a76dbf7`
- `Linux b88ad6e714284b33a47834f5f2a294c2b37c66aa`
- `Linux 471b23586387a32857778c511be60ab31c98dcfd`
- `Linux 4f529c4d1e436230d3af7c09a3239677a14d2b46`
- `Linux ae6a5394d9fbe118bc95cfe376d6a9d91d7547e8`
- `Linux 5bdf93a2f5459f944b416b188178ca4a92fd206f`
- `Linux ff3ba016263ee93a1c6209bf5ab1599de7ab1512`
- `Linux e7ca00f35d8a17af1ae19d529193ebc21bfda164`
- `Linux >= 4.9.235 < 4.10`
- `Linux >= 4.14.196 < 4.15`
- `Linux >= 4.19.143 < 4.20`
- `Linux >= 5.4.62 < 5.5`
- `Linux >= 5.8.6 < 5.9`
- `Linux >= 4.14.328 < 4.15`
- `Linux >= 4.19.297 < 4.20`
- `Linux >= 5.4.259 < 5.5`
- `Linux 5.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.