A bounds‑check in the Linux CDC NCM USB driver fails to include a required offset, allowing reads beyond the intended memory region. The flaw is a bounds‑check error (CWE‑131) and relates to integer overflow checks (CWE‑129). This can leak kernel memory or cause a kernel crash, representing a size‑calculation and integer error.

All Linux kernel versions that contain the CDC NCM driver code prior to the commit adding the ndpoffset check are affected. The issue is confined to the upstream Linux kernel and does not target particular distributions or hardware modifications.

The flaw has a CVSS base score of 7.8, indicating a high severity. The EPSS score indicates a low exploitation probability ( < 1%). The vulnerability is not listed in the CISA KEV catalog. The likely attack path is an attacker providing a malicious USB CDC NCM device; based on the description, it is inferred that crafted NDP32 packets can trigger the out‑of‑bounds read, potentially leading to information disclosure or a kernel panic. No publicly available exploit is documented, but kernel memory leakage could be used in a privileged context.