The Linux kernel contains a flaw in the f_ncm gadget driver where the variable ndp_index is signed but receives an unsigned value from get_ncm(). A host that sends a large offset can cause the signed integer to wrap into a negative value. The driver then compares this negative value against unsigned bounds, bypassing sanity checks and computing an address that falls outside the valid NDP block. This results in an out-of-bounds read that can expose kernel memory contents to the host.

This vulnerability affects the Linux kernel on systems that enable the USB Network Control Model gadget driver (f_ncm). The exact kernel versions are not listed in the advisory, so any kernel that has the unpatched f_ncm code is potentially impacted.

The flaw can be exploited by a malicious USB host that sends crafted NCM requests, providing a large offset that triggers the signed overflow. The attack requires physical or logical access to the USB device and the ability to send controlled NCM packets. The EPSS score is <1%, indicating a low probability of exploitation, while the CVSS score of 5.5 indicates a moderate severity and potential impact. The vulnerability is not currently listed in the CISA KEV catalog, and the out‑of‑bounds read bypasses sanity checks to expose kernel memory contents, making it a serious information‑disclosure risk for vulnerable hosts.