CVE-2026-68368

What it actually does

Missing bounds validation in ncm_unwrap_ntb() permits a malicious USB host to supply NTB headers with datagram offsets and lengths that exceed the declared block or remaining skb buffer, causing skb_put_data() to copy kernel memory from skb_shared_info into a network skb and resulting in an information disclosure.

Why it matters to the business

Attackers with physical or emulated USB access may obtain fragments of kernel memory that could contain credentials, keys, or other sensitive data, increasing risk of further compromise; the issue affects Linux-based USB gadget devices with moderate ecosystem prevalence.

How an attack unfolds

An attacker acting as a malicious USB host crafts one or more NTB blocks containing invalid datagram lengths or offsets that reference memory beyond the supplied buffer; when the gadget processes the malformed NTB, the missing checks allow adjacent kernel structures to be copied into the outgoing network skb, disclosing memory contents to the attacker.

How to fix it

Apply the upstream fix that adds checks for sufficient buffer space before parsing NTB headers, handling of zero-length blocks, enforcement that block lengths never exceed remaining buffer space, and strict datagram boundary validation; update to a kernel containing the resolution for f_ncm.

How to confirm the fix worked

Confirm the patch is present by inspecting the ncm_unwrap_ntb() function for the added length and boundary checks; test with a USB host emulator supplying oversized or out-of-bounds NTB descriptors and verify that no excess data is copied into the skb.

Typical attack path

1. Attacker connects a malicious or emulated USB host to a vulnerable Linux USB gadget device
2. Host transmits one or more NTB frames with crafted block lengths and datagram descriptors that exceed actual buffer boundaries or remaining skb data
3. ncm_unwrap_ntb() parses the headers without verifying block length against remaining buffer or datagram bounds within the block
4. skb_put_data() copies data from skb_shared_info into the network skb
5. Attacker receives the resulting skb containing leaked kernel memory

How to detect it

Review kernel logs for anomalies around usb gadget or f_ncm processing; inspect network traffic originating from the gadget for unexpectedly large or malformed skbs; correlate with USB connection events from untrusted hosts.

What your security team should do

• Prioritize kernel updates on all systems exposing USB gadget functionality, especially those reachable by untrusted hosts
• Restrict USB gadget interfaces to trusted hosts only via physical or policy controls until patched
• Monitor kernel changelogs for the f_ncm fix and schedule deployment within standard update cycles