Per NCAA Rules:
All players are eligible to touch, catch or recover a fumble (Exceptions: Rules 7-2-2-a-Exc.2 and 8-3-2-d-5) or a backward pass.

-AND-

When a backward pass or fumble is caught or recovered by any inbounds player, the ball continues in play.

-AND-

Definition of being "Out of Bounds"
A player is out of bounds when any part of their body touches anything other than another player or a game official on or outside a
boundary line. An out-of-bounds player who becomes airborne remains out ofbounds until they touch the ground inbounds without simultaneously being out of bounds.


So what are the exceptions -
Rules 7-2-2-a-Exc.2 =
On fourth down before a change of team possession, when a Team
A fumble is caught or recovered by a Team A player other than the
fumbler, the ball is dead. If the catch or recovery is beyond the spot of
the fumble, the ball is returned to the spot of the fumble. If the catch
or recovery is behind the spot of the fumble, the ball remains at the
spot of the catch or recovery.

8-3-2-d-5
"The try ends when:
Team A player fumbles and the ball is caught or recovered by any
Team A player other than the fumbler. There is no Team A score (A.R.
8-3-2-VIII)."



TL;DR
There is no penalty (This ain't basketball or a WR catching a pass)
Anyone can recover a fumble
If the player is out of bounds when they recover the fumble, the ball is considered dead and out of bounds. Otherwise the the player is inbounds and can recover the fumble. There are special rules associated with 4th down and the try after a touchdown as well that do NOT apply here.