CVE-2026-80814: rndis_host: add overflow check in rndis_rx_fixup()
In the Linux kernel, the following vulnerability has been resolved:
rndishost: add overflow check in rndisrxfixup()
Add an overflow check to ensure that dataoffset + datalen + 8 does not wrap, which would enable an OOB read of the USB data buffer.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to control to trigger this issue?
The attacker needs to supply USB data with crafted RNDIS packet offset and length values that cause the size calculation to wrap. This can lead the RNDIS host receive path to read beyond the USB data buffer.
Which systems are exposed?
Systems using the Linux kernel's rndis_host receive path are relevant. The issue is associated with processing USB RNDIS data, rather than general network traffic.
How can I determine whether the fix is present?
Check whether the kernel source contains the overflow validation in rndis_rx_fixup() for data_offset + data_len + 8. The referenced stable fixes include commits 2140db1232af04b92faa6c4a2a40df6371ea89ff, 8ca3bd404d076495ed0b274b65971c57b6fd5ac0, and f8e6fde5db87f855e99b200e392467274f0eb9d7.