CVE-2026-64540: Linux Kernel Information Disclosure Flaw

CVE-2026-64540 Overview

CVE-2026-64540 is an out-of-bounds read vulnerability in the Linux kernel's usbnet driver for GeneLink (GL620A) USB network devices. The flaw exists in genelink_rx_fixup() inside drivers/net/usb/gl620a.c, where a device-supplied per-packet length is not validated against the number of bytes actually received in the URB. A malicious USB device can send a short URB with a header claiming multiple packets and a first-packet length of up to 1514 bytes, causing skb_put_data() to copy adjacent slab memory into the network stack. The result is a kernel heap information leak reachable from the usbnet RX softirq path without privileges.

Critical Impact
An attacker with physical or adjacent USB access can leak kernel heap memory contents through crafted GL620A URBs, exposing sensitive kernel data as soon as the network interface is up.

Affected Products

Linux kernel usbnet driver (drivers/net/usb/gl620a.c) supporting GeneLink GL620A USB network devices
Multiple Linux stable branches prior to the fix commits referenced by the kernel maintainers
Any distribution kernel shipping the vulnerable gl620a module

Discovery Timeline

2026-07-27 - CVE-2026-64540 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64540

Vulnerability Analysis

The genelink_rx_fixup() function reassembles aggregated RX frames from a GL620A device into individual sk_buff packets. Each sub-packet is preceded by a device-supplied length field. The driver bounds this length only by the constant GL_MAX_PACKET_LEN (1514) and never compares it against the actual size of the received URB payload.

When a device claims packet_count > 1 with an oversized first-packet length, the loop calls skb_put_data(gl_skb, packet->packet_data, size) to copy size bytes from the receive buffer. Because size can exceed the remaining valid data, the copy reads past the end of the receive skb, pulling adjacent slab contents into the outbound packet.

KASAN identifies the issue as a slab-out-of-bounds read of size 1514 bytes triggered from the ksoftirqd context via usbnet_bh(). The leaked data then flows up the network stack and can be observed by an unprivileged attacker as network traffic. This class of flaw maps to Out-of-Bounds Read [CWE-125].

Root Cause

The driver trusts device-supplied length metadata without cross-checking it against the length of the received URB. The pre-patch code performs the skb_put_data() copy before skb_pull() has validated that the requested length fits within the source buffer, so a malicious length is accepted as legitimate.

Attack Vector

Exploitation requires an attacker-controlled or malicious GL620A USB device attached to the target host, or an adjacent-network scenario where such a device can be presented. Once the usbnet interface is up, the vulnerable path executes inside the RX softirq and requires no user interaction or elevated privileges. The attacker constructs a short URB whose header advertises packet_count > 1 and a first-packet length up to 1514 bytes, causing the driver to read and forward adjacent kernel heap memory.

The upstream fix reorders the packet handling so that skb_pull() verifies the requested length against the remaining buffer and returns NULL before the copy occurs. Malformed frames are rejected; well-formed aggregated frames continue to work normally.

Detection Methods for CVE-2026-64540

Indicators of Compromise

KASAN reports in dmesg referencing slab-out-of-bounds in genelink_rx_fixup or __asan_memcpy invoked from usbnet_bh.
Unexpected kernel oops or warnings originating from drivers/net/usb/gl620a.c around line 112.
Attachment of unfamiliar USB devices identifying as GeneLink GL620A (USB vendor/product identifiers matching the gl620a driver binding table).

Detection Strategies

Audit loaded kernel modules on Linux hosts for the gl620a module and correlate with kernel version to identify unpatched systems.
Monitor kernel logs for KASAN or memory-corruption traces referencing genelink_rx_fixup, usbnet_bh, or skb_put_data.
Alert on USB device insertion events (via udev, auditd, or endpoint telemetry) that bind to the gl620a driver on servers and workstations.

Monitoring Recommendations

Forward dmesg and journalctl -k output to a central logging pipeline and search for KASAN, gl620a, and usbnet strings.
Track kernel package versions across the fleet and flag hosts running kernels older than the versions containing the referenced fix commits (0575599e, 0a7d9c7c, 255d0355, 3ef79fa3, 4359376e, 573418f7, 8624e179, 8ff7f2a6).
Instrument USB attach and driver-binding events on high-value hosts to detect anomalous USB network adapters.

How to Mitigate CVE-2026-64540

Immediate Actions Required

Apply the vendor kernel update that includes the genelink_rx_fixup() bounds-check fix as soon as it is available for your distribution.
On hosts that do not require GeneLink GL620A USB Ethernet adapters, blacklist the gl620a kernel module to remove the attack surface.
Restrict physical and remote USB device attachment on servers, workstations, and kiosks using USB port control policies.

Patch Information

The upstream fix moves skb_pull() ahead of the skb_put_data() copy in drivers/net/usb/gl620a.c and checks its return value, so an oversized per-packet length is rejected before any memory is read. The fix is present in the following stable commits: Linux Kernel Commit 0575599e, Linux Kernel Commit 0a7d9c7c, Linux Kernel Commit 255d0355, Linux Kernel Commit 3ef79fa3, Linux Kernel Commit 4359376e, Linux Kernel Commit 573418f7, Linux Kernel Commit 8624e179, and Linux Kernel Commit 8ff7f2a6.

Workarounds

Blacklist the vulnerable module via /etc/modprobe.d/blacklist-gl620a.conf so it does not auto-load on USB attach.
Enforce USB device allow-listing at the endpoint or firmware level to block unknown USB Ethernet adapters.
Where feasible, disable USB host controller ports on systems that do not require USB peripherals.

bash

# Configuration example
# Prevent the vulnerable gl620a driver from loading
echo "blacklist gl620a" | sudo tee /etc/modprobe.d/blacklist-gl620a.conf
sudo rmmod gl620a 2>/dev/null || true
sudo update-initramfs -u

# Verify the module is no longer loaded
lsmod | grep gl620a || echo "gl620a not loaded"