A flaw in the f_ncm gadget driver’s NTB handling routine allows a USB host to provide NTB frame descriptors that reference memory beyond the intended datagram block. The unbounded read performed by skb_put_data copies adjacent kernel memory into the network skb, which can corrupt critical kernel data structures and lead to arbitrary code execution. The weakness is manifested as improper bounds checking and buffer under-read.

All Linux kernel configurations employing the USB gadget NCM driver are vulnerable until the bounds‑check fix is applied. Any system running a kernel version before the patch that introduced the validation code is susceptible; any machine that activates the f_ncm gadget must verify that the running kernel includes the update.

The CVSS score of 5.7 indicates medium severity. This kernel memory corruption can be triggered by a USB host that sends crafted NTB frames; thus the attack can occur when a host is physically attached or remotely connected via USB. The EPSS score is < 1%, suggesting a low probability of exploitation. This issue is not listed in the CISA KEV catalog, so public exploitation has not yet been documented. Nonetheless, the potential for privilege escalation warrants rapid mitigation.