The RNDIS gadget in the Linux kernel parses incoming packets using the rndis_rm_hdr function. In versions before the recent patch, no bounds check is performed before accessing the MessageType, MessageLength, DataOffset, and DataLength fields. An attacker can send a packet that is too short, causing the kernel to read memory beyond the supplied buffer. This out‑of‑bounds read is a classic CWE‑125 weakness that may expose kernel data or lead to a crash, compromising confidentiality, integrity, or availability of the affected system.

All Linux kernel releases that contain the unpatched RNDIS gadget code are affected. Because the CVE definition does not provide explicit version ranges, any kernel that includes the old rndis_rm_hdr routine should be considered vulnerable until the added bounds check is applied.

The EPSS score of less than 1 % indicates a very low likelihood of exploitation at present, and the vulnerability is not listed in CISA’s KEV catalog. Attackers would need physical or local USB access to a device exposing the RNDIS gadget interface. No public exploits are known, but the out‑of‑bounds read could still be leveraged to leak sensitive information or destabilize the kernel if an attacker can supply a crafted packet.