CVE-2026-64540

A flaw was found in the Linux kernel's GeneLink (GL620A) USB network driver. A malicious GeneLink device can send specially crafted Universal Serial Bus (USB) packets that cause an out-of-bounds read vulnerability. This can lead to the disclosure of sensitive kernel memory, potentially revealing confidential system information. No special privileges are required for an attacker to exploit this vulnerability.

This vulnerability is rated as having a Moderate impact because exploitation requires physical or virtual access to attach a malicious USB device to the target system. In typical Red Hat Enterprise Linux enterprise deployments, USB devices based on the GeneLink GL620A architecture are rarely utilized, significantly limiting exposure in standard server environments. While an attacker capable of connecting such a crafted peripheral could trigger an out-of-bounds read to leak uninitialized kernel memory or cause an unexpected crash, the flaw cannot be exploited remotely across a network.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.