The Linux kernel flaw in the cdc_ncm_rx_verify_ndp16 routine performs a bounds check that fails to incorporate the ndpoffset when validating the DPE array length. As a result the code may read beyond the end of the socket buffer, leaking kernel data in an out‑of‑bounds read. This could expose sensitive kernel memory to an attacker and may lead to crashes or, in a larger exploit chain, privilege escalation or denial of service.

All Linux kernel releases before the switch that adds ndpoffset to the NDP‑plus‑DPE bounds check are affected. The issue appears in the standard kernel code that handles USB CDC NCM devices and is present across the major distribution builds that ship the mainline kernel.

The vulnerability requires an attacker to supply a malicious USB CDC NCM device to the affected system; EPSS data are not available and the vulnerability is not listed in the CISA KEV catalog, however the potential for information disclosure and kernel instability indicates a high severity. The patch that adds the offset to the bounds check and uses struct_size_t resolves the problem and is the recommended mitigation.