Executive brief
The Linux kernel's USB RNDIS gadget function processes network configuration queries from USB devices. Without proper length validation in the query response handler, a malicious or compromised USB device could send specially crafted requests with invalid buffer offsets or lengths, potentially causing memory corruption or information disclosure on systems using USB gadget mode.
Technical details
The vulnerability exists in the rndis_query_response() function in drivers/usb/gadget/function/rndis.c, which processes RNDIS query messages from USB devices without validating the InformationBufferLength and InformationBufferOffset fields. An attacker controlling a USB device can craft a malicious RNDIS query message with out-of-bounds buffer parameters, leading to buffer over-read or memory access violations. The fix adds explicit bounds checking on both fields against RNDIS_MAX_TOTAL_SIZE, mirroring the existing validation in rndis_set_response(). Attack requires physical USB device or USB device emulation capability and is feasible on systems running in USB gadget mode (common in embedded/mobile devices).
Affected products
- Linux Linux kernel multiple versions through at least 6.x
Timeline
- 2026-08-10: disclosed
- 2026-07-08: patched