Hello:

This series was applied to netdev/net.git (main)
by Jakub Kicinski [off-list ref]:

On Fri, 13 Mar 2026 22:46:38 -0700 you wrote:

The nframes bounds check in cdc_ncm_rx_verify_ndp16() and
cdc_ncm_rx_verify_ndp32() does not account for ndpoffset,
allowing out-of-bounds reads when the NDP is placed near the
end of the NTB.

Changes since v2:
- Save struct_size_t() result to a temp variable to avoid
  awkward line wrapping (Jakub)
- Fix From/Signed-off-by mismatch
- Move "Compile-tested only" out of the Signed-off-by line
  into the commit message body

[...]

Here is the summary with links:
  - [v3,1/2] net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check
    https://git.kernel.org/netdev/net/c/2aa8a4fa8d5b
  - [v3,2/2] net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check
    https://git.kernel.org/netdev/net/c/77914255155e

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html