CVE-2026-80814

A flaw was found in the Linux kernel's rndis_host component. An integer overflow vulnerability exists within the rndis_rx_fixup() function. This issue arises when processing USB data, where insufficient validation of input sizes can cause a calculation to wrap around. This could lead to an out-of-bounds (OOB) read of the USB data buffer, potentially resulting in information disclosure.

This vulnerability is rated as having a Moderate impact for Red Hat Enterprise Linux because exploitation requires local access, specifically the ability to attach a physical or emulated malicious USB device. In typical environments, the rndis_host driver is only initialized when an RNDIS-compatible USB network interface is physically plugged in or attached to a virtual machine. Successful exploitation leads to an out-of-bounds memory read, primarily resulting in a kernel crash (denial of service) or potential information disclosure, without direct arbitrary code execution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.