Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV L L L N U H H H 7.8 .0013 2.2 —
AFFECTED Product Versions Fixed Linux ff06ab13a4ccae4acb44a2d4e3ece367b616ab50 – — Linux 3.8 – 6.1.188
TIMELINE Jan 13 Reserved by Linux Apr 3 Published (CNA: Linux) Sep 14 ENRICHED — CVE-2026-23448 (Linux). Received CVSS 7.8 and CPE data from NVD.
In the Linux kernel, the following vulnerability has been resolved: net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check cdc_ncm_rx_verify_ndp16() validates that the NDP header and its DPE entries fit within the skb. The first check correctly accounts for ndpoffset: if ((ndpoffset + sizeof(struct usb_cdc_ncm_ndp16)) > skb_in->len) but the second check omits it: if ((sizeof(struct usb_cdc_ncm_ndp16) + ret * (sizeof(struct usb_cdc_ncm_dpe16))) > skb_in->len) This validates the DPE array size against the total skb length as if the NDP were at offset 0, rather than at ndpoffset. When the NDP is placed near the end of the NTB (large wNdpIndex), the DPE entries can extend past the skb data buffer even though the check passes. cdc_ncm_rx_fixup() then reads out-of-bounds memory when iterating the DPE array. Add ndpoffset to the nframes bounds check and use struct_size_t() to express the NDP-plus-DPE-array size more clearly.
| Date | Event | Detail |
|---|---|---|
| January 13, 2026 | Reserved | Reserved by Linux |
| April 3, 2026 | Published | Published (CNA: Linux) |
| September 14, 2026 | ENRICHED | ENRICHED — CVE-2026-23448 (Linux). Received CVSS 7.8 and CPE data from NVD. |
Authoritative record: CVE-2026-23448 at cve.org
Vendors: linux
Weaknesses: CWE-129
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-23448 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
