A previously missing length check in the RNDIS USB gadget response handling routine has been added, preventing the overflow that could corrupt kernel memory. The vulnerability could allow an attacker controlling a USB device to send a specially crafted RNDIS response, causing the kernel to read beyond the bounds of a buffer and potentially overwrite arbitrary memory. This flaw allows local privilege escalation or, if triggered on a system with broader privileges, could result in kernel corruption and system compromise. The weakness is a classic buffer overflow scenario (CWE‑805).

Linux kernel implementations that support the USB gadget RNDIS function are affected. Any device running a kernel prior to the fix in the listed commit sequence (particularly kernels in the 6.x series before the patch) is vulnerable. Users of older kernels or custom builds lacking this commit should be examined for exposure.

Based on the description, the flaw represents a kernel‑level buffer overflow that could enable code execution. The likely attack vector is inferred to involve sending malicious RNDIS queries over USB to the target device; this would require USB connectivity to the vulnerable gadget. No public exploit is listed, and the EPSS score of < 1% indicates a very low likelihood of exploitation. The CVSS score is not stated in the data, and the vulnerability is not listed in CISA’s KEV catalog. The potential harm warrants prompt remediation.