In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check for header Add a length check for… (CVE-2026-64505)
A vulnerability in the Linux kernel's USB gadget function for RNDIS was resolved by adding a length check for the RNDIS header. This ensures that critical fields such as MessageType, MessageLength, DataOffset, and DataLength are verified to be present before access, preventing potential out-of-bounds or invalid memory access issues.
AI Analysis
Technical Summary
The Linux kernel's USB gadget RNDIS function lacked proper length validation for the RNDIS header in the rndis_rm_hdr function. The fix adds a length check to confirm that the MessageType, MessageLength, DataOffset, and DataLength fields exist before they are accessed, thereby addressing a vulnerability that could lead to improper memory handling.
Potential Impact
Without the length check, accessing these fields without validation could cause memory corruption or kernel crashes. The vulnerability could potentially be exploited by a local or remote attacker interacting with the USB gadget interface to cause denial of service or other unintended behavior. However, no known exploits in the wild have been reported.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to add the necessary length checks. Users should update to the patched kernel version once available. Patch status is not explicitly confirmed in the provided data; therefore, check the official Linux kernel advisories or vendor patches for the exact fixed versions and remediation instructions.
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check for header Add a length check for… (CVE-2026-64505)
Description
A vulnerability in the Linux kernel's USB gadget function for RNDIS was resolved by adding a length check for the RNDIS header. This ensures that critical fields such as MessageType, MessageLength, DataOffset, and DataLength are verified to be present before access, preventing potential out-of-bounds or invalid memory access issues.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel's USB gadget RNDIS function lacked proper length validation for the RNDIS header in the rndis_rm_hdr function. The fix adds a length check to confirm that the MessageType, MessageLength, DataOffset, and DataLength fields exist before they are accessed, thereby addressing a vulnerability that could lead to improper memory handling.
Potential Impact
Without the length check, accessing these fields without validation could cause memory corruption or kernel crashes. The vulnerability could potentially be exploited by a local or remote attacker interacting with the USB gadget interface to cause denial of service or other unintended behavior. However, no known exploits in the wild have been reported.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to add the necessary length checks. Users should update to the patched kernel version once available. Patch status is not explicitly confirmed in the provided data; therefore, check the official Linux kernel advisories or vendor patches for the exact fixed versions and remediation instructions.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-qg2c-f29c-cqr6
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64505"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a6542069c2644c7f8081d99
Added to database: 07/25/2026, 23:08:54 UTC
Last enriched: 07/25/2026, 23:12:57 UTC
Last updated: 07/26/2026, 05:51:54 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.