Heimdall Security Logo

CVE-2026-31617

Vulnérabilité moyenne dans Linux (Linux)

CVSS 5.5 · Moyenne
EPSS 0.2%
Linux•Linux•Versions : <=6.1.*, 4.9.235, <=7.0.*, <=6.12.*, <8b3b7bd3c02f98634baaf36c7fc7ac915f6517ca, 0, 6.12.83, 7.0.1, <4.10, <8f993d30b95dc9557a8a96ceca11abed674c8acb, <068a7f2749fff6462a0a908ec415b885fe430f50, <d58ba8f6546232f8414f396c189297dbee03f1a7, 471b23586387a32857778c511be60ab31c98dcfd, 5.15.209, <8757a2593631443648218244b9788e193ae0fdc1, <4.20, <=5.10.*, <=6.6.*, 6.1.175, <0f156bb5334e588034ca68ac2ee92b23f66e56e7, 6.6.136, <=6.19.*, 2b74b0a04d3e9f9f08ff026e5663dce88ff94e52, ae6a5394d9fbe118bc95cfe376d6a9d91d7547e8, <5.5, 7.1, <74908b0318d1df1188457040b8714ff4d4b68126, b88ad6e714284b33a47834f5f2a294c2b37c66aa, <=6.18.*, 5.9, <5.9, 5.10.258, <=*, 6.19.14, 5.8.6, 4.14.196, f7e0611e207d8908c4f2858e244370529a76dbf7, <=5.15.*, <6762f8a95772265dd0c2ffe7f400493f3115b135, <1425655c2870054c3ab4712e2b6dbdd331597ada, 5.4.62, <4.15, 4.19.143, 6.18.24, 4f529c4d1e436230d3af7c09a3239677a14d2b46

Description

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() The block_len read from the host-supplied NTB header is checked against ntb_max but has no lower bound. When block_len is smaller than opts->ndp_size, the bounds check of: ndp_index > (block_len - opts->ndp_size) will underflow producing a huge unsigned value that ndp_index can never exceed, defeating the check entirely. The same underflow occurs in the datagram index checks against block_len - opts->dpe_size. With those checks neutered, a malicious USB host can choose ndp_index and datagram offsets that point past the actual transfer, and the skb_put_data() copies adjacent kernel memory into the network skb. Fix this by rejecting block lengths that cannot hold at least the NTB header plus one NDP. This will make block_len - opts->ndp_size and block_len - opts->dpe_size both well-defined. Commit 8d2b1a1ec9f5 ("CDC-NCM: avoid overflow in sanity checking") fixed a related class of issues on the host side of NCM.

Gravité et risque d'exploitation

CVE-2026-31617 obtient un score CVSS de 5.5/10, soit une gravité moyenne. Selon le modèle EPSS, la probabilité qu'elle soit exploitée dans les 30 prochains jours est de 0.18 %, ce qui la place devant 6.9 % des CVE référencées.

Que faire ?

  • Vérifiez si Linux (versions <=6.1.*, 4.9.235, <=7.0.*, <=6.12.*, <8b3b7bd3c02f98634baaf36c7fc7ac915f6517ca, 0, 6.12.83, 7.0.1, <4.10, <8f993d30b95dc9557a8a96ceca11abed674c8acb, <068a7f2749fff6462a0a908ec415b885fe430f50, <d58ba8f6546232f8414f396c189297dbee03f1a7, 471b23586387a32857778c511be60ab31c98dcfd, 5.15.209, <8757a2593631443648218244b9788e193ae0fdc1, <4.20, <=5.10.*, <=6.6.*, 6.1.175, <0f156bb5334e588034ca68ac2ee92b23f66e56e7, 6.6.136, <=6.19.*, 2b74b0a04d3e9f9f08ff026e5663dce88ff94e52, ae6a5394d9fbe118bc95cfe376d6a9d91d7547e8, <5.5, 7.1, <74908b0318d1df1188457040b8714ff4d4b68126, b88ad6e714284b33a47834f5f2a294c2b37c66aa, <=6.18.*, 5.9, <5.9, 5.10.258, <=*, 6.19.14, 5.8.6, 4.14.196, f7e0611e207d8908c4f2858e244370529a76dbf7, <=5.15.*, <6762f8a95772265dd0c2ffe7f400493f3115b135, <1425655c2870054c3ab4712e2b6dbdd331597ada, 5.4.62, <4.15, 4.19.143, 6.18.24, 4f529c4d1e436230d3af7c09a3239677a14d2b46) est présent sur votre parc.
  • Appliquez le correctif ou la version corrigée indiqués dans les références de l'éditeur.
  • À défaut de correctif, limitez l'exposition (filtrage réseau, désactivation du composant).
  • Automatisez la détection : les agents CVE Heimdall (gratuits, open source) corrèlent l'inventaire de vos serveurs avec la base CVE.

Références

Rechercher une autre CVE