The Linux kernel project disclosed a vulnerability this week that allows a USB host to read sensitive memory from connected Linux devices using a networking feature called CDC-NCM. Tracked as CVE-2026-31617, the flaw sits in the f_ncm driver, which handles the device side of USB Ethernet connections. A malicious or compromised computer can send specially crafted network transfer blocks that trigger an out-of-bounds read, potentially leaking encryption keys, pointers, or other kernel data into network packets.

What Just Broke: The USB NCM Gadget Vulnerability Explained

The bug affects Linux’s USB gadget subsystem—the code that lets a Linux system pretend to be a USB device when plugged into a host PC. In this case, the specific function ncm_unwrap_ntb() parses a Network Transfer Block (NTB) sent by the host. The kernel already checked if the block length exceeded a maximum, but missed a critical lower bound.

When a host supplies a block length smaller than the minimum size needed to hold an NTB header plus one Network Datagram Pointer (NDP), the arithmetic block_len - opts->ndp_size underflows. Since the value is unsigned, subtracting a larger number from a smaller one wraps around to a huge number—on a 32-bit system, it could be near 4 GB. This invalid length then passes later bounds checks and causes skb_put_data() to copy memory from outside the actual USB transfer buffer and into a network packet. The attacker can then read that packet if they control the host, effectively extracting adjacent kernel memory.

Microsoft’s Security Response Center notes that the fix is already upstream and heading to stable kernels, with the patch adding a minimum length check: a block must be at least opts->nth_size + opts->ndp_size bytes, or the transfer is rejected entirely.

Who’s at Risk—and Who Isn’t

This isn’t a vulnerability you’ll trigger by plugging a random USB stick into your laptop. The attack requires a malicious or compromised host computer to connect to a Linux device that has f_ncm loaded and configured as a gadget. The risk falls into three camps:

For Home Users and Tinkerers

If you use a Raspberry Pi, BeagleBone, or similar single-board computer as a USB Ethernet gadget (often for headless setup or network sharing), and you plug it into unknown or shared PCs, you’re vulnerable. The fix is straightforward: update your kernel and avoid plugging into untrusted machines. Disable the NCM gadget function if you only need serial or mass-storage modes.

For IT Administrators and Enterprise

The real danger is in fleets of embedded Linux devices—industrial controllers, point-of-sale terminals, medical equipment, network appliances—that use USB NCM for maintenance or provisioning. If a service laptop used to update these devices gets compromised, it could silently harvest memory from every gadget it touches. Even a short-lived info leak can expose credentials or kernel pointers, leading to further compromise. Check your device inventory for any system that makes itself appear as a USB network interface to a host, and verify whether usb_f_ncm.ko is loaded.

Windows Users: Mostly Bystanders—but with a Twist

A standard Windows PC is not affected by this CVE. It doesn’t run a vulnerable Linux kernel, and simply plugging a Linux gadget into Windows won’t infect the Windows machine. However, a Windows laptop used to service Linux devices could itself be the attack vector: if that Windows machine gets malware, it could then target any connected Linux gadget. So the takeaway for Windows admins is to harden provisioning and maintenance machines—keep them updated, locked down, and never use a personal laptop to debug a production device.

Windows Subsystem for Linux (WSL) is also largely unaffected because the WSL2 kernel doesn’t expose a USB gadget interface, and USB passthrough doesn’t enable gadget mode by default. Microsoft’s advisory confirms that this CVE does not require a Windows update; it’s purely a Linux kernel issue, tracked through the Microsoft ecosystem because of Azure and Linux integration.

The Road to CVE-2026-31617: How USB Gadgets Became a Target

USB gadget mode has quietly become the backbone of many development workflows. When you connect a Raspberry Pi to your laptop and it shows up as a new Ethernet adapter, that’s likely NCM or its older sibling ECM. The CDC-NCM standard is faster and more efficient than legacy protocols like RNDIS, so it’s the default on many Linux distributions.

The vulnerable function ncm_unwrap_ntb() has been in the kernel for years, but the missing lower-bound check was only recently discovered. According to the patch commit, an earlier fix addressed similar sanity checks on the host side, but the gadget side’s arithmetic underflow remained. This is a classic parser bug: one validation seems right, but a later calculation depends on an assumption the first check didn’t enforce.

The timeline is short:
- Late 2025/early 2026: Underflow discovered (likely through code review or fuzzing).
- May 2026: Patch submitted to the Linux netdev mailing list and merged into mainline.
- June 2026: Stable kernels 6.1.x, 6.6.x, 7.x, etc. receive backports. The NVD entry is published but still awaiting CVSS enrichment.

What to Do Right Now

Step 1: Check If You’re Affected

On any Linux machine that might serve as a USB device, run:

lsmod | grep usb_f_ncm

or check /sys/kernel/config/usb_gadget/ for an ncm function directory. If you see the module loaded or the gadget configured, you need to act.

Step 2: Patch Immediately

Grab the latest kernel from your distribution. For mainstream distros:
- Ubuntu: apt update && apt upgrade linux-image-generic (check changelogs for CVE-2026-31617).
- Fedora: dnf upgrade kernel* (Fedora 40 and 41 have backports).
- Debian: aptitude update && aptitude upgrade linux-image-amd64 (track stable-security).
- Raspberry Pi OS: sudo apt upgrade raspberrypi-kernel.
- Custom builds: Cherry-pick commit a4b7fbb from the kernel Git repo (exact hash may vary; look for “ncm: fix NTB block length check”).

Note: Many embedded devices run vendor kernels. Contact the device manufacturer for a firmware update. Do not rely solely on uname -r because backports often don’t bump the version string.

Step 3: Mitigate If You Can’t Patch Yet

  • Disable the NCM gadget function: either remove it from the configfs gadget configuration or unload the module (modprobe -r usb_f_ncm). This may break USB networking, so test first.
  • Only connect the device to trusted machines—dedicated, air-gapped maintenance laptops that are never used for email or web browsing.
  • If the device supports it, switch to ECM or RNDIS temporarily, though these protocols have their own security caveats.

Step 4: Reassess Your USB Trust Model

Treat any USB-to-device connection as a potential attack path, especially in industrial or lab environments. Physical access doesn’t equal safety. Consider:
- Using hardware USB firewalls or data diodes for sensitive gadgets.
- Logging and monitoring USB gadget connections on maintenance hosts.
- Isolating provisioning networks from the internet.

The Outlook: More Parsing Bugs to Come?

This vulnerability is part of a pattern we’ve seen across many protocol parsers—USB, Bluetooth, Wi-Fi—where small arithmetic oversights lead to memory safety violations. The Linux kernel’s USB gadget subsystem is particularly tricky because it’s a device-facing stack, often overlooked in threat models that focus on host-side attacks.

We expect the NVD to assign a CVSS base score in the 6–7 range (Medium-High) due to the adjacent access requirement but potentially serious confidentiality impact. The fix is trivial and widely backportable, so patch speed should be high.

For the Windows world, this is a reminder that Microsoft’s security advisory system now tracks Linux CVEs that could affect Azure, WSL, or interoperability scenarios. Windows admins should not ignore these advisories; they might not need to patch Windows, but they may need to secure the Linux gadgets their team relies on.