Cloudanix VulnDB

CVE-2026-80814

None

CVSS

—

EPSS

0.2%

Published

Sep 4, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in how Linux handles certain USB network sticks could let a plugged-in device read a little extra memory it shouldn't, which might cause crashes or leaks but is unlikely to be exploited.

Chainable
Exploitation
Physical Access
Attacker needs
Physical Access
Complexity
Low
Impact
Data Exposure
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Missing integer overflow check in rndis_rx_fixup allows data_offset + data_len + 8 to wrap, enabling out-of-bounds read from the USB receive buffer in the Linux kernel RNDIS host driver.

Why it matters to the business

Linux systems using USB RNDIS network adapters face risk of kernel memory disclosure or crashes when processing malicious USB traffic, potentially affecting device stability and confidentiality on affected hosts though overall exploit likelihood remains low.

How an attack unfolds

An attacker crafts a malicious RNDIS response packet over USB where the offset and length fields are chosen to cause arithmetic wrap-around; the missing check permits the driver to read past the end of the allocated buffer, disclosing adjacent kernel memory or triggering a fault.

How to fix it

Apply the upstream kernel commit that adds the overflow check in rndis_rx_fixup; rebuild and deploy the patched kernel on all affected systems; disable RNDIS USB support where not required.

How to confirm the fix worked

Verify the presence of the overflow check (data_offset + data_len + 8 does not wrap) in the rndis_rx_fixup function of the running kernel source or binary; test with crafted RNDIS frames in a lab environment to confirm no OOB access occurs.

Typical attack path

  1. Connect malicious or compromised USB device presenting as RNDIS host
  2. Send crafted RNDIS packet with offset/length values that trigger wrap
  3. Trigger rndis_rx_fixup processing path
  4. Read or fault on out-of-bounds kernel memory

How to detect it

Search kernel logs and dmesg for rndis_rx_fixup oops, warnings, or USB RNDIS packet processing anomalies; inspect USB traffic captures for RNDIS messages with suspiciously large or wrapping offset/length fields.

  • rndis_rx_fixup
  • RNDIS response with data_offset + data_len wrap

What your security team should do

  • Prioritize kernel updates on systems exposing USB RNDIS interfaces
  • Restrict USB device classes via policy or hardware controls if RNDIS is unnecessary
  • Monitor kernel logs for rndis-related faults or warnings
  • Reassess EPSS and KEV status weekly given low current scores

The record

In the Linux kernel, the following vulnerability has been resolved: rndis_host: add overflow check in rndis_rx_fixup() Add an overflow check to ensure that data_offset + data_len + 8 does not wrap, which would enable an OOB read of the USB data buffer.

Affected packages

Ecosystem Package Introduced Fixed