Executive brief
A vulnerability was identified in the Linux kernel's USB RNDIS (Remote Network Driver Interface Specification) gadget driver. This component allows a Linux device to act as a virtual network card when connected to a computer via USB. An attacker with physical or local access to the USB interface could potentially cause a system crash or memory corruption by sending specially crafted, undersized network packets that the system fails to validate before processing.
Technical details
A vulnerability exists in the `rndis_rm_hdr` function within `drivers/usb/gadget/function/rndis.c` of the Linux kernel. The code failed to verify that an incoming socket buffer (skb) contained at least 16 bytes before attempting to access the RNDIS header fields (MessageType, MessageLength, DataOffset, and DataLength). An attacker providing a truncated packet could trigger an out-of-bounds read or memory corruption. The fix introduces a check to ensure `skb->len` is at least 16 bytes, otherwise the packet is dropped and an error is returned. This affects systems using the USB gadget framework with RNDIS enabled.
Affected products
- Linux Linux Kernel < 5.10.261, < 5.15.212, < 6.1.178, < 6.6.145, < 6.12.96, < 6.18.39, < 7.1.4
Timeline
- 2026-07-25: disclosed
- 2026-07-25: advisory
- 2026-07-24: patched
References
- https://git.kernel.org/stable/c/200dd5092296ad4d5ae47f8445a2fb1edd1da973
- https://git.kernel.org/stable/c/21b5bf155435008e0fb0736795289788e63d426f
- https://git.kernel.org/stable/c/7515a6d4a9e9e4838b833825882efa00e85f8901
- https://git.kernel.org/stable/c/9facd79028a7807879eb441d12f0e00720980aa3
- https://git.kernel.org/stable/c/9ffd567d7bf269824dfac06f8ab9a32fef72699b
- https://git.kernel.org/stable/c/b73c0142e3acdc063b50c33afb7be19cdb2cd410
- https://git.kernel.org/stable/c/ba2cc601e59fe68716646199a33303493513e2e3