CVE-2026-68368: Linux kernel · usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb()
Affects Linux kernelSource GCVE Database
Not known to be exploited · fixed in 5.15.0-1117.124~20.04.1 : update Linux kernel when convenient.
Data as of 26 Oct 2026, 14:05 UTC
Rated by Threat Radar · CVSS not yet scored by NVD
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 11% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 5.15.0-1117.124~20.04.1, 5.15.0-1123.132~20.04.1, 5.15.0-1122.131~20.04.1 +41
Exploitation evidence
Disclosed: evidence found.
CVE published 10 Aug 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade to a fixed release listed under Affected software.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Ubuntu 26.04 LTSlinuxpkg:deb/ubuntu/linux?arch=source&distro=resoluteOther threats | Affected
| Fixed in
|
Ubuntu 26.04 LTSlinux-awspkg:deb/ubuntu/linux-aws?arch=source&distro=resoluteOther threats | Affected
| Fixed in
|
Ubuntu 26.04 LTSlinux-azurepkg:deb/ubuntu/linux-azure?arch=source&distro=resoluteOther threats | Affected
| Fixed in
|
Ubuntu 26.04 LTSlinux-azure-fdepkg:deb/ubuntu/linux-azure-fde?arch=source&distro=resoluteOther threats | Affected
| Fixed in
|
Ubuntu 26.04 LTSlinux-gcppkg:deb/ubuntu/linux-gcp?arch=source&distro=resoluteOther threats | Affected
| Fixed in
|
Ubuntu 26.04 LTSlinux-gkepkg:deb/ubuntu/linux-gke?arch=source&distro=resoluteOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() When unpacking host-supplied NTBs, ncm_unwrap_ntb() checks datagram length against frame_max but does not verify that the datagram fits within the declared block length. Additionally, when decoding multiple NTBs from a single socket buffer, subsequent block lengths are not checked against the actual remaining buffer data. With these checks missing, a malicious USB host can specify datagram offsets and lengths that point beyond the block, or supply secondary NTB headers declaring lengths larger than the buffer. skb_put_data() then copies adjacent kernel memory from skb_shared_info into the network skb. Fix this by verifying that sufficient buffer space remains for the NTB header before parsing, handling zero-length block declarations, ensuring that block lengths never exceed the remaining buffer space, and verifying that each datagram payload stays strictly within the block boundary.
References
- ubuntu.com/security/CVE-2026-68368 (opens in a new tab)
- cve.org/CVERecord?id=CVE-2026-68368 (opens in a new tab)
- git.kernel.org/stable/c/fff1059d139ef798bab917990524faaf25854ca8 (opens in a new tab)
- git.kernel.org/stable/c/40c706a0224bde194667e3378c689b542fec4b44 (opens in a new tab)
- git.kernel.org/stable/c/e07751d0527ccc2a1c32eb0b0b7da3b4b9b5381f (opens in a new tab)
- git.kernel.org/stable/c/1febec7e47cdcd01f43fb0211094e3010474666e (opens in a new tab)
- git.kernel.org/stable/c/41fd5f2fb0027d3773ae949e3247c2e0a2a7fe5c (opens in a new tab)
- ubuntu.com/security/notices/USN-8876-1 (opens in a new tab)
- ubuntu.com/security/notices/USN-8878-1 (opens in a new tab)
- ubuntu.com/security/notices/USN-8879-1 (opens in a new tab)
- ubuntu.com/security/notices/USN-8877-1 (opens in a new tab)
- ubuntu.com/security/notices/USN-8875-1 (opens in a new tab)
- ubuntu.com/security/notices/USN-8888-1 (opens in a new tab)
- ubuntu.com/security/notices/USN-8889-1 (opens in a new tab)
- ubuntu.com/security/notices/USN-8887-1 (opens in a new tab)
- ubuntu.com/security/notices/USN-8888-2 (opens in a new tab)
- ubuntu.com/security/notices/USN-8887-2 (opens in a new tab)
- ubuntu.com/security/notices/USN-8875-2 (opens in a new tab)
- ubuntu.com/security/notices/USN-8887-3 (opens in a new tab)