CVE-2026-68368: usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb()

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb()

When unpacking host-supplied NTBs, ncm_unwrap_ntb() checks datagram length
against frame_max but does not verify that the datagram fits within the
declared block length. Additionally, when decoding multiple NTBs from a
single socket buffer, subsequent block lengths are not checked against the
actual remaining buffer data.

With these checks missing, a malicious USB host can specify datagram
offsets and lengths that point beyond the block, or supply secondary NTB
headers declaring lengths larger than the buffer. skb_put_data() then
copies adjacent kernel memory from skb_shared_info into the network skb.

Fix this by verifying that sufficient buffer space remains for the NTB
header before parsing, handling zero-length block declarations, ensuring
that block lengths never exceed the remaining buffer space, and verifying
that each datagram payload stays strictly within the block boundary.

The Linux kernel CVE team has assigned CVE-2026-68368 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.9 with commit 2b74b0a04d3e9f9f08ff026e5663dce88ff94e52 and fixed in 6.6.148 with commit e07751d0527ccc2a1c32eb0b0b7da3b4b9b5381f
	Issue introduced in 5.9 with commit 2b74b0a04d3e9f9f08ff026e5663dce88ff94e52 and fixed in 6.12.101 with commit fff1059d139ef798bab917990524faaf25854ca8
	Issue introduced in 5.9 with commit 2b74b0a04d3e9f9f08ff026e5663dce88ff94e52 and fixed in 6.18.42 with commit 40c706a0224bde194667e3378c689b542fec4b44
	Issue introduced in 5.9 with commit 2b74b0a04d3e9f9f08ff026e5663dce88ff94e52 and fixed in 7.1.6 with commit 41fd5f2fb0027d3773ae949e3247c2e0a2a7fe5c
	Issue introduced in 5.9 with commit 2b74b0a04d3e9f9f08ff026e5663dce88ff94e52 and fixed in 7.2-rc5 with commit 1febec7e47cdcd01f43fb0211094e3010474666e
	Issue introduced in 4.9.235 with commit f7e0611e207d8908c4f2858e244370529a76dbf7
	Issue introduced in 4.14.196 with commit b88ad6e714284b33a47834f5f2a294c2b37c66aa
	Issue introduced in 4.19.143 with commit 471b23586387a32857778c511be60ab31c98dcfd
	Issue introduced in 5.4.62 with commit 4f529c4d1e436230d3af7c09a3239677a14d2b46
	Issue introduced in 5.8.6 with commit ae6a5394d9fbe118bc95cfe376d6a9d91d7547e8
	Issue introduced in 4.14.328 with commit 5bdf93a2f5459f944b416b188178ca4a92fd206f
	Issue introduced in 4.19.297 with commit ff3ba016263ee93a1c6209bf5ab1599de7ab1512
	Issue introduced in 5.4.259 with commit e7ca00f35d8a17af1ae19d529193ebc21bfda164

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-68368
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/usb/gadget/function/f_ncm.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/e07751d0527ccc2a1c32eb0b0b7da3b4b9b5381f
	https://git.kernel.org/stable/c/fff1059d139ef798bab917990524faaf25854ca8
	https://git.kernel.org/stable/c/40c706a0224bde194667e3378c689b542fec4b44
	https://git.kernel.org/stable/c/41fd5f2fb0027d3773ae949e3247c2e0a2a7fe5c
	https://git.kernel.org/stable/c/1febec7e47cdcd01f43fb0211094e3010474666e