What is CVE-2026-23447?

CVE-2026-23447 is a High severity Linux kernel vulnerability with a CVSS score of 7.8 out of 10, affecting Linux kernel versions from 4.14.317 onward and patched in 6.6.130, 6.12.78, 6.18.20 and others. CVE-2026-23447 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2026-23447?

CVE-2026-23447 has a CVSS score of 7.8 out of 10, rated High severity. The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Is there a patch available for CVE-2026-23447?

Yes, CVE-2026-23447 has been patched. Fixed versions include 6.6.130, 6.12.78, 6.18.20 and others. If you are running Linux kernel 4.14.317 or later up to the fix versions, apply the relevant patch for your kernel branch.

Is CVE-2026-23447 actively exploited?

CVE-2026-23447 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

CVE-2026-23447

High

In the Linux kernel, the following vulnerability has been resolved: net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check The same bounds-check bug fixed for NDP16 in the previous patch also exists in cdc_ncm_rx_verify_ndp32(). The DPE array size is validated against the total skb length without accounting for ndpoffset, allowing out-of-bounds reads when the NDP32 is placed near the end of the NTB. Add ndpoffset to the nframes bounds check and use struct_size_t() to express the NDP-plus-DPE-array size more clearly. Compile-tested only.

Package Linux Kernel

Published 2026-04-03

Last modified 2026-07-24

CVSS version 3.1

Patch available

Yes

CVSS 3.1 score

7.8

out of 10

High

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness type

CWE-129

CVE-2026-23447 is classified as CWE-129

See CWE-129 on MITRE CWE for full details on this weakness type.

Affected versions

Linux kernel versions 4.14.317, 4.19.285, 5.4.245, 5.7 and later are affected. Fixed in 6.6.130, 6.12.78, 6.18.20, 6.19.10, 7.0 and their respective stable series.

Affected from

≥ 4.14.317 ≥ 4.19.285 ≥ 5.4.245 ≥ 5.7

Fixed in

✓ 6.6.130 6.6.x ✓ 6.12.78 6.12.x ✓ 6.18.20 6.18.x ✓ 6.19.10 6.19.x ✓ 7.0

References

5 total

Kernel Git
https://git.kernel.org/stable/c/125f932a76a97904ef8a555f1dd53e5d0e288c54

Patch
Kernel Git
https://git.kernel.org/stable/c/77914255155e68a20aa41175edeecf8121dac391

Patch
Kernel Git
https://git.kernel.org/stable/c/a5bd5a2710310c965ea4153cba4210988a3454e2

Patch
Kernel Git
https://git.kernel.org/stable/c/af0d1613d6751489dbf9f69aac1123f0b1e566e5

Patch
Kernel Git
https://git.kernel.org/stable/c/de70da1fb1d152e981ecb3157f7ec2b633005c16

Patch

Details

CVE ID CVE-2026-23447

Severity High

CVSS score 7.8 / 10

CVSS version 3.1

Published 2026-04-03

Modified 2026-07-24

KEV No

Patch

Yes

Package linux

Frequently asked questions

What is CVE-2026-23447?

CVE-2026-23447 is a High severity Linux kernel vulnerability with a CVSS score of 7.8 out of 10 . It affects Linux kernel versions from 4.14.317 onward and has been patched in 6.6.130, 6.12.78, 6.18.20 and others. CVE-2026-23447 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
What is the CVSS score for CVE-2026-23447?

CVE-2026-23447 has a CVSS score of 7.8 out of 10, rated High severity (CVSS 3.1). The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Is there a patch available for CVE-2026-23447?

Yes. CVE-2026-23447 has been patched. Fixed versions include 6.6.130, 6.12.78, 6.18.20 and others. If you are running Linux kernel 4.14.317 or later up to the fix versions, apply the relevant patch for your kernel branch.
Is CVE-2026-23447 actively exploited?

No. CVE-2026-23447 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.