A numeric underflow in the USB NCM driver allows a hostile USB host to supply a block length that is smaller than the minimum required for a valid NTB header. This underflow corrupts bounds checks on NDP and datagram indices, enabling the driver to copy kernel memory into a network socket buffer. The resulting memory vulnerability can be abused to inject corrupted data into the kernel or to trigger a crash, giving an attacker the possibility to gain elevated privileges or to cause a denial of service.

Any system running a Linux kernel with the USB gadget NCM driver is potentially affected. The vulnerability applies to all kernel versions prior to the defect‑fix commit and is not limited to a specific distribution; all vendors that ship unpatched kernels are at risk.

The CVSS score of 5.5 indicates a medium severity. The EPSS score of less than 1% implies that exploitation is unlikely in the wild, and the vulnerability is not listed in the CISA KEV catalog. The exploit requires a malicious USB host that can control the NTB header, which is a local and relatively easy vector to present to a device with USB gadget functionality. Because the flaw allows arbitrary kernel memory contamination, an attacker could potentially execute code at kernel privilege or cause a system crash if the driver is active on the target device.