The vulnerability resides in the Linux kernel's USB CDC Network Control Model (cdc_ncm) driver. A bounds‑check bug in the function cdc_ncm_rx_verify_ndp32() allows the driver to read beyond the end of a DPE array when an NDP32 frame is positioned near the boundary of the NTB. This out‑of‑bounds read can expose kernel memory contents to a crafted USB device and may lead to information disclosure or kernel panic.

The affected product is the Linux kernel. Versions that incorporate the buggy driver implementation are unspecified, but any Linux distribution compiling the kernel from sources that include the pre‑patch code lacks protection. Users of standard kernel releases released before the fix are potentially impacted.

No CVSS score or EPSS data is provided, so the quantified severity and likelihood remain unknown. Based on the description, a local attacker with physical access could supply a malicious USB device that sends an NDP32 packet near the NTB boundary to trigger the out‑of‑bounds read. The exploit requires the vulnerable driver to be loaded and the device to be connected, making it a local USB‑based attack vector. The risk is mitigated once the kernel is updated to a patched version that includes bounds‑checking for ndpoffset.