Answer in brief
CVE-2026-31617 records a Medium severity (CVSS 5.5) vulnerability in usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb(). The current sources do not mark it as known exploited. The current feed maps Red Hat/kernel (generic), Linux/Linux (generic), Linux/Linux (generic), Siemens/SIMATIC S7-1500 TM MFP - GNU/Linux subsystem (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Red Hat/kernel (generic), Linux/Linux (generic), Linux/Linux (generic), Siemens/SIMATIC S7-1500 TM MFP - GNU/Linux subsystem (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Red Hat/kernelgeneric | * | Not reported |
| Linux/Linuxgeneric | >=2b74b0a04d3e9f9f08ff026e5663dce88ff94e52 <068a7f2749fff6462a0a908ec415b885fe430f50 || >=2b74b0a04d3e9f9f08ff026e5663dce88ff94e52 <1425655c2870054c3ab4712e2b6dbdd331597ada || >=2b74b0a04d3e9f9f08ff026e5663dce88ff94e52 <8b3b7bd3c02f98634baaf36c7fc7ac915f6517ca || >=2b74b0a04d3e9f9f08ff026e5663dce88ff94e52 <0f156bb5334e588034ca68ac2ee92b23f66e56e7 || >=2b74b0a04d3e9f9f08ff026e5663dce88ff94e52 <8757a2593631443648218244b9788e193ae0fdc1 || >=2b74b0a04d3e9f9f08ff026e5663dce88ff94e52 <6762f8a95772265dd0c2ffe7f400493f3115b135 || >=2b74b0a04d3e9f9f08ff026e5663dce88ff94e52 <d58ba8f6546232f8414f396c189297dbee03f1a7 || >=2b74b0a04d3e9f9f08ff026e5663dce88ff94e52 <74908b0318d1df1188457040b8714ff4d4b68126 || >=2b74b0a04d3e9f9f08ff026e5663dce88ff94e52 <8f993d30b95dc9557a8a96ceca11abed674c8acb || f7e0611e207d8908c4f2858e244370529a76dbf7 || b88ad6e714284b33a47834f5f2a294c2b37c66aa || 471b23586387a32857778c511be60ab31c98dcfd || 4f529c4d1e436230d3af7c09a3239677a14d2b46 || ae6a5394d9fbe118bc95cfe376d6a9d91d7547e8 || >=4.9.235 <4.10 || >=4.14.196 <4.15 || >=4.19.143 <4.20 || >=5.4.62 <5.5 || >=5.8.6 <5.9 | 068a7f2749fff6462a0a908ec415b885fe430f50, 1425655c2870054c3ab4712e2b6dbdd331597ada, 8b3b7bd3c02f98634baaf36c7fc7ac915f6517ca, 0f156bb5334e588034ca68ac2ee92b23f66e56e7, 8757a2593631443648218244b9788e193ae0fdc1, 6762f8a95772265dd0c2ffe7f400493f3115b135, d58ba8f6546232f8414f396c189297dbee03f1a7, 74908b0318d1df1188457040b8714ff4d4b68126, 8f993d30b95dc9557a8a96ceca11abed674c8acb, 4.10, 4.15, 4.20, 5.5, 5.9 |
| Linux/Linuxgeneric | 5.9 | Not reported |
| Siemens/SIMATIC S7-1500 TM MFP - GNU/Linux subsystemgeneric | >=0 <* | * |
Published upstream
Apr 24, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 15, 2026
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() The block_len read from the host-supplied NTB header is checked against ntb_max but has no lower bound. When block_len is smaller than opts->ndp_size, the bounds check of: ndp_index > (block_len - opts->ndp_size) will underflow producing a huge unsigned value that ndp_index can never exceed, defeating the check entirely. The same underflow occurs in the datagram index checks against block_len - opts->dpe_size. With those checks neutered, a malicious USB host can choose ndp_index and datagram offsets that point past the actual transfer, and the skb_put_data() copies adjacent kernel memory into the network skb. Fix this by rejecting block lengths that cannot hold at least the NTB header plus one NDP. This will make block_len - opts->ndp_size and block_len - opts->dpe_size both well-defined. Commit 8d2b1a1ec9f5 ("CDC-NCM: avoid overflow in sanity checking") fixed a related class of issues on the host side of NCM.
Quoted source text, attributed separately from HOL analysis.