The gl620a USB network driver contains an out‑of‑bounds read in the function that splits aggregated receive frames. The driver uses per‑packet lengths supplied by the GL620A device and only ensures that each length is less than the maximum packet size of 1514 bytes. It never verifies that the claimed length fits into the actually received buffer. A malicious device can therefore send a short URB whose headers advertise more packets than were transmitted and a packet size larger than the data received. When the driver copies this data it reads beyond the end of the receive buffer, leaking kernel heap contents. The primary impact is the disclosure of kernel memory, which could be used to infer sensitive information or to aid in further attacks. This weakness corresponds to the classic out‑of‑bounds read identified as CWE‑125.

The vulnerability exists in the Linux kernel usbnet driver for GL620A devices. All kernel releases that include the unpatched gl620a implementation, regardless of distribution, are affected. No specific vendor version numbers were supplied, so any build that has not applied the commit that fixes the bounds check remains vulnerable.

The defect is exercised in the USB network interface handler, which runs in the softirq context as soon as the interface is up. No user privileges are required; the attacker only needs to supply a malicious USB device that advertises an oversized packet. At present the EPSS score is below 1%, and the issue is not listed in CISA’s KEV catalog, indicating no known active exploit. Nonetheless, the possibility of reading arbitrary kernel memory represents a moderate risk while the device is connected, motivating timely mitigation.