CVE-2026-80814: Linux Kernel RNDIS Buffer Overflow

CVE-2026-80814 Overview

CVE-2026-80814 is a Linux kernel vulnerability in the rndis_host USB networking driver. The flaw resides in the rndis_rx_fixup() function, which processes incoming Remote Network Driver Interface Specification (RNDIS) packets from USB devices. The function failed to validate that the arithmetic expression data_offset + data_len + 8 does not wrap around due to integer overflow. An attacker with a crafted USB device can trigger an out-of-bounds (OOB) read of the USB data buffer. The Linux kernel maintainers resolved the issue by adding an explicit overflow check before the buffer access.

Critical Impact
A malicious or malformed USB RNDIS device can cause the kernel to read outside the bounds of the receive buffer, leading to information disclosure or kernel instability.

Affected Products

Linux kernel — rndis_host USB networking driver
Distributions shipping vulnerable kernel versions prior to the referenced stable patches
Systems with USB RNDIS device support enabled

Discovery Timeline

2026-09-04 - CVE-2026-80814 published to the National Vulnerability Database (NVD)
2026-09-07 - Last updated in NVD database

Technical Details for CVE-2026-80814

Vulnerability Analysis

The rndis_host driver implements the Microsoft RNDIS protocol used by many USB-tethered network devices. When a USB packet arrives, rndis_rx_fixup() parses the RNDIS header to locate the payload within the received skb buffer. The parsing logic uses two attacker-influenced fields, data_offset and data_len, and adds a constant of 8 to compute the end of the data region.

Without an overflow check, a crafted device can supply values large enough that the sum wraps around the 32-bit integer boundary. The wrapped result appears smaller than the buffer length, bypassing subsequent bounds validation. The kernel then reads past the end of the USB data buffer, exposing adjacent kernel memory contents or causing a fault.

Root Cause

The root cause is missing integer overflow validation on untrusted length arithmetic, an instance of an Integer Overflow leading to an Out-of-Bounds Read. The fix introduces a check that ensures data_offset + data_len + 8 cannot wrap before the values are used to index into the received buffer.

Attack Vector

Exploitation requires the attacker to control a USB device that speaks RNDIS or to induce a target to attach one. When the vulnerable driver binds to the device, the malicious RNDIS header fields are processed by rndis_rx_fixup(), triggering the OOB read. Physical or supply-chain access to the USB port is typically required. The vulnerability is described in prose only; see the referenced kernel commits for the exact patch content.

// No verified proof-of-concept code is available.
// Refer to the upstream kernel commits listed in the references
// for the exact patch applied to drivers/net/usb/rndis_host.c

Detection Methods for CVE-2026-80814

Indicators of Compromise

Kernel log entries referencing rndis_host errors, malformed RNDIS packets, or unexpected skb length mismatches
Sudden kernel oops or soft lockups occurring after a USB device is attached
Unexpected USB devices registering as RNDIS network interfaces on endpoints or servers

Detection Strategies

Inventory running kernel versions across the fleet and correlate against the stable branches patched by commits 10a6b990, 2140db12, 2ded89ca, 8ca3bd40, 965a251f, be7dc365, c5398ce6, e971d956, and f8e6fde5.
Monitor udev and dmesg for the appearance of new usb0/RNDIS interfaces on systems that do not normally use USB tethering.
Alert on kernel panics or driver faults originating from drivers/net/usb/rndis_host.c.

Monitoring Recommendations

Forward kernel and USB subsystem logs to a centralized data lake for long-term analysis and correlation.
Track USB device insertion events, including vendor and product identifiers, on sensitive hosts such as domain controllers and jump servers.
Establish a baseline of expected USB peripherals per host class and alert on deviations.

How to Mitigate CVE-2026-80814

Immediate Actions Required

Apply the stable kernel update that contains the rndis_rx_fixup() overflow check as soon as your distribution publishes it.
Reboot affected hosts after patching to load the fixed kernel image.
Restrict physical access to USB ports on high-value systems until patches are deployed.

Patch Information

The Linux kernel maintainers merged fixes across multiple stable branches. Reference the upstream commits: Kernel Patch Commit 10a6b99, Kernel Patch Commit 2140db12, Kernel Patch Commit 2ded89ca, Kernel Patch Commit 8ca3bd40, Kernel Patch Commit 965a251f, Kernel Patch Commit be7dc365, Kernel Patch Commit c5398ce6, Kernel Patch Commit e971d956, and Kernel Patch Commit f8e6fde5.

Workarounds

Blacklist the rndis_host kernel module on systems that do not require USB RNDIS tethering.
Use USB port control policies, such as USBGuard, to prevent unauthorized RNDIS devices from binding.
Disable USB ports at the firmware level on servers and kiosks where removable networking is not needed.

bash

# Blacklist the rndis_host module and prevent it from loading
echo 'blacklist rndis_host' | sudo tee /etc/modprobe.d/blacklist-rndis.conf
echo 'install rndis_host /bin/true' | sudo tee -a /etc/modprobe.d/blacklist-rndis.conf
sudo update-initramfs -u
sudo rmmod rndis_host 2>/dev/null || true