What is the CVSS score of CVE-2026-23448?

CVE-2026-23448 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Linux Kernel are affected by CVE-2026-23448?

A memory disclosure vulnerability in Linux kernel's USB CDC NCM driver could allow local attackers with access to compromised USB devices to read sensitive kernel memory; no public exploit identified…. A patch is available.

How to fix or mitigate CVE-2026-23448?

Within 24 hours: Identify Linux systems with cdc_ncm driver enabled using 'modinfo cdc_ncm' or 'lsmod | grep cdc_ncm'; assess whether they accept untrusted USB devices. Within 7 days: Apply available Linux kernel patch (consult linux-kernel.org and your Linux distribution's security advisories for specific kernel versions) to all identified systems, prioritizing those in high-risk USB environments. Within 30 days: Complete patching across organization; disable cdc_ncm driver on systems not requiring USB CDC NCM functionality.

Linux Kernel CVE-2026-23448

EUVD-2026-18696 HIGH

Improper Validation of Array Index (CWE-129)

2026-04-03 Linux

GHSA-pjhh-88pp-3hg6

Linux Buffer Overflow Red Hat Suse

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

5.5 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

May 21, 2026 - 00:58 vuln.today

v2 (cvss_changed)

Re-analysis Queued

May 21, 2026 - 00:52 vuln.today

cvss_changed

CVSS changed

May 21, 2026 - 00:52 NVD

7.8 (HIGH)

Patch available

Apr 16, 2026 - 05:29 EUVD

789204f980730258c983102c027c375238009c80,2aa8a4fa8d5b7d0e1ebcec100e1a4d80a1f4b21a,403f94ddcb36c552fbef51dea735b131e3dcde8b

EUVD ID Assigned

Apr 03, 2026 - 15:30 euvd

EUVD-2026-18696

Analysis Generated

Apr 03, 2026 - 15:30 vuln.today

CVE Published

Apr 03, 2026 - 15:15 nvd

N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check

cdc_ncm_rx_verify_ndp16() validates that the NDP header and its DPE entries fit within the skb. The first check correctly accounts for ndpoffset:

if ((ndpoffset + sizeof(struct usb_cdc_ncm_ndp16)) > skb_in->len)

but the second check omits it:

if ((sizeof(struct usb_cdc_ncm_ndp16) + ret * (sizeof(struct usb_cdc_ncm_dpe16))) > skb_in->len)

This validates the DPE array size against the total skb length as if the NDP were at offset 0, rather than at ndpoffset. When the NDP is placed near the end of the NTB (large wNdpIndex), the DPE entries can extend past the skb data buffer even though the check passes. cdc_ncm_rx_fixup() then reads out-of-bounds memory when iterating the DPE array.

Add ndpoffset to the nframes bounds check and use struct_size_t() to express the NDP-plus-DPE-array size more clearly.

AnalysisAI

Out-of-bounds read in the Linux kernel's cdc_ncm USB networking driver allows a local attacker with a malicious or compromised USB CDC NCM device to read kernel memory beyond the skb buffer. The flaw lives in cdc_ncm_rx_verify_ndp16(), where the NDP16 nframes bounds check omits the ndpoffset value, letting DPE array iteration in cdc_ncm_rx_fixup() walk past the legitimate buffer when wNdpIndex points near the end of the NTB. No public exploit identified at time of analysis and EPSS exploitation probability is 0.02% (5th percentile), but a patch is available from upstream Linux maintainers.

Technical ContextAI

The cdc_ncm driver implements the USB CDC NCM (Network Control Model) protocol used by USB network adapters and tethered mobile broadband devices. Incoming NCM Transfer Blocks (NTBs) are parsed into an NDP16 header followed by an array of DPE16 (Datagram Pointer Entry) records that describe individual frames. cdc_ncm_rx_verify_ndp16() is supposed to ensure both the NDP header and the DPE array reside fully within the received skb. The root cause is CWE-129 (Improper Validation of Array Index): the first length check correctly added ndpoffset, but the second check compared sizeof(NDP16)+nframes*sizeof(DPE16) against skb_in->len as if the NDP started at offset 0. When wNdpIndex is large, the DPE array effectively extends past the data buffer and cdc_ncm_rx_fixup() reads out-of-bounds kernel memory. Affected CPE is cpe:2.3:a:linux:linux across the affected stable branches, with the fix introducing ndpoffset into the check and using struct_size_t() for clarity.

RemediationAI

Vendor-released patch: upgrade to Linux stable 6.6.130, 6.12.78, 6.18.20, 6.19.10, or mainline 7.0-rc5, whichever matches your branch, by pulling the upstream fix commits at git.kernel.org/stable/c/789204f980730258c983102c027c375238009c80 and the related backports (403f94ddcb36c552fbef51dea735b131e3dcde8b, dce9dda0e3707e887977db44407989e9ead26611, 2aa8a4fa8d5b7d0e1ebcec100e1a4d80a1f4b21a, f1c7701d3ac91b62d672c13690cf295821f0d5c3). For distribution kernels, install the vendor's updated kernel package as soon as the backport ships and reboot. If patching is delayed, blacklist the cdc_ncm module on hosts that do not use USB CDC NCM tethering or modems (echo 'blacklist cdc_ncm' into /etc/modprobe.d/), which prevents the vulnerable parsing path entirely at the cost of breaking USB tethering and certain LTE/5G dongles; alternatively restrict USB device attachment via USBGuard policies or kernel.unprivileged_userns_clone hardening on multi-user systems, accepting the operational overhead of an allow-list. Consult https://nvd.nist.gov/vuln/detail/CVE-2026-23448 and https://vuldb.com/vuln/355133 for additional advisory context.

Same weakness CWE-129 – Improper Validation of Array Index

View all

CVE-2016-9053 CRITICAL POC

9.8

CVE-2020-27485 CRITICAL POC

9.9

CVE-2020-27483 CRITICAL POC

9.9

CVE-2024-24563 CRITICAL POC

9.8

CVE-2017-8797 HIGH

7.5

CVE-2018-11489 HIGH POC

8.8

CVE-2026-56770 HIGH POC

8.7

CVE-2017-7228 HIGH POC

8.2

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2017-11882 HIGH POC

7.8

CVE-2010-3333 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: High

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7	Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7	Fixed

CVE-2026-23448 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-23448

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-129 – Improper Validation of Array Index

Same technique Buffer Overflow

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code