CVE-2026-31617

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb()

The block_len read from the host-supplied NTB header is checked against

ntb_max but has no lower bound. When block_len is smaller than

opts->ndp_size, the bounds check of:

ndp_index > (block_len - opts->ndp_size)

will underflow producing a huge unsigned value that ndp_index can never

exceed, defeating the check entirely.

The same underflow occurs in the datagram index checks against block_len

- opts->dpe_size. With those checks neutered, a malicious USB host can

choose ndp_index and datagram offsets that point past the actual

transfer, and the skb_put_data() copies adjacent kernel memory into the

network skb.

Fix this by rejecting block lengths that cannot hold at least the NTB

header plus one NDP. This will make block_len - opts->ndp_size and

block_len - opts->dpe_size both well-defined.

Commit 8d2b1a1ec9f5 ("CDC-NCM: avoid overflow in sanity checking") fixed

a related class of issues on the host side of NCM.