CVE-2026-74679

Description

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_ncm: Use unsigned int for ndp_index The variable ndp_index is declared as a signed integer, but it stores the return value of get_ncm(), which is unsigned. A malicious host can supply a large offset that overflows the signed ndp_index, making it negative. Because ndp_index is compared against unsigned bounds, this negative value bypasses sanity checks and leads to an out-of-bounds read when calculating the address of the NDP block (ntb_ptr + ndp_index). Fix this by changing ndp_index to unsigned int to ensure consistent unsigned comparisons throughout the function.

Is your site exposed to CVE-2026-74679?

Run a free security scan — no signup, results in seconds.

EPSS — Exploit Prediction

0.0019

Probability of exploitation

0.08%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/11413d7ed42174b8f5d8d0b6a25d10dc88239b21 https://git.kernel.org/stable/c/5b2b3a3229a3f4c493ffdee53aee2f173b6f13b3 https://git.kernel.org/stable/c/6b1c8a9403a26cb0fed7a648916c74dc236da591 https://git.kernel.org/stable/c/9c8c6825a750fcd3efbe922847ca70ccd5a66857 https://git.kernel.org/stable/c/a1c0deeba4a46481543d6b09c665f758c54c3a1a https://git.kernel.org/stable/c/d13f650a3485b58c124b3cda45597e8002c9c833 https://git.kernel.org/stable/c/d328fdc607fa1bb668ad512e1c918a120f78f337 https://git.kernel.org/stable/c/fc9e54e22845c4da29588ca0986cb7c795b5a262

Frequently Asked Questions

What is CVE-2026-74679? +

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_ncm: Use unsigned int for ndp_index The variable ndp_index is declared as a signed integer, but it stores the return value of get_ncm(), which is unsigned. A malicious host can supply a large offset that overflows the signed ndp_index, making it negative. Because ndp_index is compared against unsigned bounds, this negative value bypasses sanity checks and leads to an out-of-bounds read when calculating the address of the NDP block (ntb_ptr + ndp_index). Fix this by changing ndp_index to unsigned int to ensure consistent unsigned comparisons throughout the function.

How do I check if I'm vulnerable to CVE-2026-74679? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.