A flaw in the Linux kernel’s rndis_host driver allowed an integer overflow during USB data parsing. The calculation of data_offset plus data_len plus an additional eight bytes could wrap around, enabling an out‑of‑bounds read of the USB buffer. This vulnerability could expose sensitive data stored in kernel memory, potentially leaking private information but not directly granting code execution.

The issue exists in all versions of the Linux kernel that use the rndis_host module before the patch that adds the overflow check. No specific version range is provided, so any kernel lacking this fix is vulnerable.

The EPSS score is not available and the vulnerability is not listed in CISA’s KEV, indicating limited evidence of active exploitation. Without a publicly known exploit and without a direct privilege escalation path, the risk to most deployments is moderate. Attackers would need control over a USB device or the ability to manipulate RNDIS packets; the likely vector is a malicious USB device connected to the host.