CVE-2026-64505: Linux Kernel RNDIS Header Vulnerability

CVE-2026-64505 Overview

CVE-2026-64505 is a Linux kernel vulnerability in the USB gadget RNDIS (Remote Network Driver Interface Specification) function. The flaw exists in the rndis_rm_hdr handler, which accessed the MessageType, MessageLength, DataOffset, and DataLength fields of the RNDIS header without first verifying that the incoming buffer was large enough to contain them. A malformed or truncated RNDIS packet can trigger an out-of-bounds read on kernel memory. The upstream fix adds an explicit length check before those fields are dereferenced.

Critical Impact
A short or crafted RNDIS packet processed by the USB gadget stack can cause out-of-bounds reads in kernel space, leading to potential information disclosure or a denial-of-service condition on the affected host.

Affected Products

Linux kernel — USB gadget RNDIS function (drivers/usb/gadget/function/rndis.c)
Multiple stable branches receiving backported fixes (see kernel.org stable commits)
Systems exposing USB gadget RNDIS mode, including embedded devices and Android tethering interfaces

Discovery Timeline

2026-07-25 - CVE-2026-64505 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64505

Vulnerability Analysis

The Linux kernel USB gadget subsystem implements RNDIS to emulate an Ethernet interface over USB. When a peer transmits an RNDIS data message, the function rndis_rm_hdr strips the RNDIS header from the incoming socket buffer before passing the payload upstream. Prior to the fix, the routine cast the buffer head to a header structure and read the MessageType, MessageLength, DataOffset, and DataLength fields without verifying that skb->len was at least sizeof(struct rndis_packet_msg_type).

A remote or local peer that sends an RNDIS frame shorter than the header size causes the kernel to read past the end of the allocated skb data. Depending on adjacent memory contents, the outcome ranges from bogus length calculations that mishandle subsequent frame parsing to leaking uninitialized kernel memory. The patch adds the missing bounds check and returns an error when the buffer is too short.

Root Cause

The root cause is missing input validation on attacker-controlled packet data before pointer dereference. This is an out-of-bounds read pattern typical of protocol parsers that trust length-prefixed fields without first confirming the fields themselves are present in the buffer.

Attack Vector

Exploitation requires the ability to deliver RNDIS frames to a Linux host acting as a USB gadget with the RNDIS function enabled. Realistic scenarios include a malicious USB peripheral connected to a gadget-mode target, tethering endpoints on mobile or embedded Linux devices, and lab or test harnesses that expose RNDIS over USB. No authentication is required at the RNDIS layer; the attack is against a peer that already has physical or logical USB connectivity.

No public proof-of-concept code has been released. The vulnerability is described in prose in the upstream commit messages; refer to the Kernel Stable Commit 21b5bf1 and the Kernel Stable Commit 9ffd567 for the patched code paths.

Detection Methods for CVE-2026-64505

Indicators of Compromise

Unexpected kernel warnings, KASAN slab-out-of-bounds reports, or oops messages referencing rndis_rm_hdr or drivers/usb/gadget/function/rndis.c
Repeated USB gadget RNDIS reconnections or malformed-frame counters incrementing on the gadget interface
Unexplained kernel panics on embedded or mobile Linux devices immediately following USB attach events

Detection Strategies

Enable CONFIG_KASAN on test builds to surface out-of-bounds reads in rndis_rm_hdr during fuzzing of USB gadget descriptors
Compare running kernel versions against the fixed stable trees referenced in the eight kernel.org commits linked in this advisory
Fuzz the USB gadget RNDIS endpoint with short and malformed frames in a controlled environment to confirm patched behavior

Monitoring Recommendations

Forward kernel logs (dmesg, journalctl -k) from embedded and mobile Linux fleets to a central log platform and alert on rndis or usb_gadget stack traces
Track USB attach and detach events on production gadget-mode devices to correlate with kernel faults
Maintain an inventory of devices that enable the g_ether or configfs-based RNDIS function so patch status can be tracked per device class

How to Mitigate CVE-2026-64505

Immediate Actions Required

Upgrade to a Linux kernel release that includes the rndis_rm_hdr length check backport for your stable branch
On systems where RNDIS gadget mode is not required, disable the RNDIS function or unload the usb_f_rndis module
Restrict physical and logical USB access to gadget-mode devices, especially in kiosks, ATMs, and industrial deployments

Patch Information

The fix has been merged into mainline and backported to multiple stable branches. Reference commits include 200dd50, 21b5bf1, 7515a6d, 9facd79, 9ffd567, b73c014, ba2cc60, and d6ef5af. Distribution maintainers should pull the appropriate commit for their supported kernel line.

Workarounds

Remove or blacklist the usb_f_rndis and g_ether kernel modules on systems that do not need USB Ethernet gadget functionality
In configfs-based gadget configurations, do not instantiate the rndis.usb0 function until a patched kernel is deployed
Enforce USB port lockdown policies via BIOS, MDM, or udev rules to prevent untrusted peers from attaching to gadget-mode interfaces

bash

# Disable the RNDIS gadget function until the kernel is patched
sudo modprobe -r usb_f_rndis
sudo modprobe -r g_ether
echo 'blacklist usb_f_rndis' | sudo tee /etc/modprobe.d/blacklist-rndis.conf
echo 'blacklist g_ether'    | sudo tee -a /etc/modprobe.d/blacklist-rndis.conf
sudo update-initramfs -u