AIKIDO-2026-657228

TL;DR

The USB device CDC NCM control handler builds fixed-size responses for the GET_NTB_PARAMETERS and GET_NTB_INPUT_SIZE class requests and copies the whole structure into the control buffer while ignoring the host-supplied wLength. The control buffer is allocated with a capacity of exactly wLength bytes, and the copy helper only bounds itself with an assertion that is compiled out in production builds. A connected host that issues one of these standard requests with a wLength smaller than the response overflows the pool buffer by up to a few dozen bytes, corrupting adjacent allocations and crashing the USB stack. The fix clamps the copy length to the minimum of the structure size and wLength.