A bounds‑check in the Linux CDC NCM USB driver fails to include a required offset, allowing reads beyond the intended memory region. The flaw can leak kernel memory or cause a kernel crash, representing a size‑calculation error (CWE‑131).

All Linux kernel versions that contain the CDC NCM driver code prior to the commit adding the ndpoffset check are affected. The issue is confined to the upstream Linux kernel and does not target particular distributions or hardware modifications.

The flaw has a CVSS base score of 7.0, indicating a high severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. The attack path is an attacker providing a malicious USB CDC NCM device; based on the description, it is inferred that crafted NDP32 packets can trigger the out‑of‑bounds read, potentially leading to information disclosure or a kernel panic. No publicly available exploit is documented, but kernel memory leakage could be used in a privileged context.