CVE-2026-64505 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: function: rndis: add length check for header
Add a length check for the rndis header in rndis_rm_hdr, to ensure that MessageType, MessageLength, DataOffset, and DataLength fields are present before they are accessed.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/26/2026
This vulnerability resides within the Linux kernel's usb gadget framework specifically affecting the RNDIS (Remote Network Driver Interface Specification) function implementation. The issue manifests as a potential out-of-bounds memory access condition that could be exploited by malicious actors to cause system instability or potentially execute arbitrary code. The vulnerability occurs in the rndis_rm_hdr function where the RNDIS header fields are processed without proper validation of the header structure's integrity.
The technical flaw stems from insufficient input validation within the RNDIS protocol handler when processing incoming USB gadget requests. Specifically, the MessageType, MessageLength, DataOffset, and DataLength fields are accessed directly without verifying that these fields actually exist within the received buffer before dereferencing them. This lack of bounds checking creates a scenario where malformed or truncated RNDIS headers could lead to memory corruption when the kernel attempts to read these fields from potentially invalid memory locations. The vulnerability represents a classic case of improper input validation that can result in information disclosure, denial of service, or privilege escalation depending on the execution context.
The operational impact of this vulnerability is significant within environments that utilize USB gadget functionality with RNDIS networking capabilities. Systems running Linux kernels with affected versions could be vulnerable to remote exploitation through malicious USB gadget devices or network traffic that triggers the flawed RNDIS processing path. The attack surface includes embedded systems, network appliances, and any device implementing USB gadget mode with RNDIS support where an attacker could potentially inject malformed headers to trigger the vulnerability.
Security mitigations for this vulnerability primarily involve applying the kernel patch that introduces proper length validation before accessing the RNDIS header fields. The fix implements a comprehensive check to ensure that all required header fields are present within the received buffer before any field access occurs, preventing out-of-bounds memory reads. This approach aligns with common security best practices and follows the principle of least privilege by validating input data before processing. Organizations should prioritize patching affected systems and monitoring for potential exploitation attempts in their network traffic. The vulnerability classification aligns with CWE-129 and CWE-787, representing improper input validation and out-of-bounds read conditions respectively. From an attack perspective, this vulnerability could map to ATT&CK techniques involving privilege escalation through kernel exploits or denial of service via memory corruption attacks.