The Linux kernel’s RNDIS gadget driver contains a race condition that allows concurrent modification of class, subclass, and protocol options via configfs. This flaw can lead to corrupted data structures or inadvertent crashes within the driver loop, potentially resulting in a local denial of service or system instability. The vulnerability arises from insufficient synchronization when accessing these options during configuration operations.

All versions of the Linux kernel that expose the RNDIS gadget driver through configfs are potentially affected until the patch that introduces a mutex is applied. No specific kernel releases are listed, so the risk applies broadly to any unpatched device using the RNDIS gadget interface.

The flaw is a local race condition; it requires an attacker with write access to the configfs interface to trigger concurrent changes. The CVSS score of 4.7 indicates moderate severity. Given the EPSS score of < 1% and absence in CISA KEV, exploitation is unlikely but not impossible. The exploit would involve orchestrating simultaneous writes to the RNDIS option configuration, leading to possible driver instability.