From: Jakub Kicinski <kuba@kernel.org>
Date: Tue, 17 Mar 2026 03:14:50 +0000 (-0700)
Subject: Merge branch 'net-usb-cdc_ncm-add-ndpoffset-to-ndp-nframes-bounds-check'
X-Git-Tag: v7.0-rc5~31^2~22
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b9ba668296ffd6143b01b0545a52bcda44f94837;p=thirdparty%2Fkernel%2Flinux.git

Merge branch 'net-usb-cdc_ncm-add-ndpoffset-to-ndp-nframes-bounds-check'

tobgaertner says:

====================
net: usb: cdc_ncm: add ndpoffset to NDP nframes bounds check

The nframes bounds check in cdc_ncm_rx_verify_ndp16() and
cdc_ncm_rx_verify_ndp32() does not account for ndpoffset,
allowing out-of-bounds reads when the NDP is placed near the
end of the NTB.
====================

Link: https://patch.msgid.link/20260314054640.2895026-1-tob.gaertner@me.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---

b9ba668296ffd6143b01b0545a52bcda44f94837