Incorrect buffer length handling in the ncp_read_kernel function in
fs/ncpfs/ncplib_kernel.c in the Linux kernel through 4.15.11, and in
drivers/staging/ncpfs/ncplib_kernel.c in the Linux kernel 4.16-rc through
4.16-rc6, could be exploited by malicious NCPFS servers to crash the kernel
or execute code.

Silvio Cesare discovered a buffer overwrite existed in the NCPFS
implementation in the Linux kernel. A remote attacker controlling a
malicious NCPFS server could use this to cause a denial of service (system
crash) or possibly execute arbitrary code.