CVE-2026-68368
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb()
When unpacking host-supplied NTBs, ncm_unwrap_ntb() checks datagram length
against frame_max but does not verify that the datagram fits within the
declared block length. Additionally, when decoding multiple NTBs from a
single socket buffer, subsequent block lengths are not checked against the
actual remaining buffer data.
With these checks missing, a malicious USB host can specify datagram
offsets and lengths that point beyond the block, or supply secondary NTB
headers declaring lengths larger than the buffer. skb_put_data() then
copies adjacent kernel memory from skb_shared_info into the network skb.
Fix this by verifying that sufficient buffer space remains for the NTB
header before parsing, handling zero-length block declarations, ensuring
that block lengths never exceed the remaining buffer space, and verifying
that each datagram payload stays strictly within the block boundary.
CSIRTS triage
- What
- The Linux kernel USB gadget ncm driver fails to validate datagram bounds in ncm_unwrap_ntb(), allowing memory corruption or denial of service.
- Who is affected
- Linux systems with USB gadget mode enabled and the NCM network interface in use.
- Urgency
- High priority with CVSS 7.1; memory corruption via kernel USB driver warrants rapid remediation.
- Action
- Apply Linux kernel security updates addressing CVE-2026-68368 to systems with USB gadget functionality.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-68368
Get an email if CVE-2026-68368 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.21% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 11% of all EPSS-scored CVEs.
Advisory coverage (2)
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-68368)