The Linux kernel's USB gadget function f_ncm used a signed integer variable ndp_index to store the return value of get_ncm(), which is unsigned. This type mismatch allows a malicious host to provide a large offset that overflows ndp_index, making it negative. Since ndp_index is compared against unsigned bounds, the negative value bypasses sanity checks, resulting in an out-of-bounds read when computing the NDP block address (ntb_ptr + ndp_index). The vulnerability is fixed by changing ndp_index to unsigned int, ensuring consistent unsigned comparisons throughout the function.

A malicious host can exploit this vulnerability to cause an out-of-bounds read in the Linux kernel's USB gadget f_ncm function. This could potentially lead to information disclosure or kernel memory corruption depending on how the out-of-bounds read is leveraged. No known exploits in the wild have been reported.

A fix for this vulnerability has been implemented by changing the ndp_index variable from signed int to unsigned int in the Linux kernel source code. Users should apply the official Linux kernel updates that include this fix once available. Patch status is not yet confirmed; check the vendor advisory for current remediation guidance.