CVE-2023-54110

In the Linux kernel, the following vulnerability has been resolved: usb: rndishost: Secure rndisquery check against int overflow Variables off and len typed as uint32 in rndisquery function are controlled by incoming RNDIS response message thus their value may be manipulated. Setting off to a...

CVE-2023-54110 usb: rndis_host: Secure rndis_query check against int overflow

In the Linux kernel, the following vulnerability has been resolved: usb: rndishost: Secure rndisquery check against int overflow Variables off and len typed as uint32 in rndisquery function are controlled by incoming RNDIS response message thus their value may be manipulated. Setting off to a...

CVE-2023-54110 usb: rndis_host: Secure rndis_query check against int overflow

In the Linux kernel, the following vulnerability has been resolved: usb: rndishost: Secure rndisquery check against int overflow Variables off and len typed as uint32 in rndisquery function are controlled by incoming RNDIS response message thus their value may be manipulated. Setting off to a...

CVE-2023-54110

The CVE-2023-54110 issue is in the Linux kernel's usb rndis_host rndis_query path, where off and len (uint32) can be influenced by a received RNDIS response, enabling an out-of-bounds access and information leakage (e.g., via OID_802_3_PERMANENT_ADDRESS). Connected advisories (SUSE, EulerOS, Astr...

CVE-2022-50704

In the Linux kernel, the following vulnerability has been resolved: USB: gadget: Fix use-after-free during usb config switch In the process of switching USB config from rndis to other config, if the hardware does not support the -pullup callback, or the hardware encounters a low probability fault...

PT-2025-52934

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel's USB gadget functionality that can lead to a use-after-free condition during a USB configuration switch. Specifically, the issue occurs when switching...

PT-2025-53187

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel’s rndis query function where variables off and len, typed as uint32, are susceptible to manipulation through incoming RNDIS response messages. An attack...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989019)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989019 advisory. In the Linux kernel, the following vulnerability has been resolved: usb: gadget: rndis: prevent integer overflow in rndissetresponse If BufOffset is very large the...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988685)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988685 advisory. In the Linux kernel, the following vulnerability has been resolved: usb: gadget: rndis: add spinlock for rndis response list There's no lock for rndis response list...

EUVD-2025-36983

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: frndis: Refactor bind path to use free After an bind/unbind cycle, the rndis-notifyreq is left stale. If a subsequent bind fails, the unified error label attempts to free this stale request, leading to a NULL pointer...

UBUNTU-CVE-2025-40095

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: frndis: Refactor bind path to use free After an bind/unbind cycle, the rndis-notifyreq is left stale. If a subsequent bind fails, the unified error label attempts to free this stale request, leading to a NULL pointer...

CVE-2025-40095 usb: gadget: f_rndis: Refactor bind path to use __free()

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: frndis: Refactor bind path to use free After an bind/unbind cycle, the rndis-notifyreq is left stale. If a subsequent bind fails, the unified error label attempts to free this stale request, leading to a NULL pointer...

Linux Distros Unpatched Vulnerability : CVE-2025-40095

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: gadget: frndis: Refactor bind path to use free After an bind/unbind cycle, the rndis-notifyreq is left stale. If a subsequent bind fails, the unified error...

EUVD-2021-27098

Malware in sbrugna...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-414331)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-414331 advisory. In rndisqueryoid in drivers/net/wireless/rndiswlan.c in the Linux kernel through 6.1.5, there is an integer overflow in an addition. Tenable has extracted the...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-414444)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-414444 advisory. An issue was discovered in drivers/usb/gadget/function/rndis.c in the Linux kernel before 5.16.10. The RNDIS USB gadget lacks validation of the size of the RNDISMSGS...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-986357)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986357 advisory. In the Linux kernel, the following vulnerability has been resolved: usb: gadget: rndis: prevent integer overflow in rndissetresponse If BufOffset is very large the...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-986323)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986323 advisory. In the Linux kernel, the following vulnerability has been resolved: usb: gadget: rndis: prevent integer overflow in rndissetresponse If BufOffset is very large the...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-986950)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986950 advisory. In the Linux kernel, the following vulnerability has been resolved: usb: gadget: rndis: prevent integer overflow in rndissetresponse If BufOffset is very large the...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987034)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987034 advisory. In the Linux kernel, the following vulnerability has been resolved: usb: gadget: rndis: add spinlock for rndis response list There's no lock for rndis response list...