Executive brief
The Linux kernel's RNDIS (Remote NDIS) USB network driver contains an integer overflow vulnerability in packet processing. A specially crafted USB device could trigger an out-of-bounds memory read, potentially leading to information disclosure or denial of service. This affects systems with USB RNDIS network adapters connected.
Technical details
The vulnerability is an integer overflow in the rndis_rx_fixup() function within drivers/net/usb/rndis_host.c. The vulnerable code failed to check whether the sum of data_offset + data_len + 8 could wrap around due to integer overflow before using it to validate USB data buffer boundaries. An attacker controlling a malicious USB RNDIS device can craft packets with carefully chosen offset and length values that wrap around, causing the function to read beyond the allocated USB data buffer. The fix adds explicit overflow checks using check_add_overflow() helpers before performing the boundary validation. Network-level preconditions exist: a USB RNDIS device must be connected and processed locally; this is not a remotely exploitable vulnerability. Patches have been applied to the Linux kernel stable tree.
Affected products
- Linux Linux kernel Multiple versions (2.6.11 through 7.2)
Timeline
- 2026-09-04: disclosed
- 2026-08-27: patched