Linux Kernel Gadget Function Vulnerability Affecting USB Components

CVE-2026-64505

What is CVE-2026-64505?

A vulnerability exists within the Linux kernel's USB gadget functionality, specifically concerning the RNDIS implementation. This flaw allows for potential memory access issues by failing to validate the length of the RNDIS header prior to its use. The fields such as MessageType, MessageLength, DataOffset, and DataLength must be checked to prevent unauthorized access and ensure system integrity. This issue underscores the importance of robust input validation practices in system design.

References