CVE-2026-64540

Received Received - Intake

Out-of-Bounds Read in Linux Kernel USBNet GL620A Driver

Publication date: 2026-07-27

Last updated on: 2026-07-30

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() genelink_rx_fixup() splits an aggregated RX frame into its individual packets, using a per-packet length taken from device-supplied data. That length is only bounded by GL_MAX_PACKET_LEN (1514); it is never compared against how many bytes were actually received. A malicious GeneLink (GL620A) device can therefore send a short URB whose header claims packet_count > 1 and a first packet of up to 1514 bytes. skb_put_data(gl_skb, packet->packet_data, size); then copies past the end of the receive buffer and hands the adjacent slab contents up the network stack, an out-of-bounds read that leaks kernel heap. No privilege is required: the path runs in the usbnet RX softirq as soon as the interface is up. BUG: KASAN: slab-out-of-bounds in genelink_rx_fixup (drivers/net/usb/gl620a.c:112) Read of size 1514 at addr ffff888011309708 by task ksoftirqd/0/14 Call Trace: ... __asan_memcpy (mm/kasan/shadow.c:105) genelink_rx_fixup (include/linux/skbuff.h:2814 drivers/net/usb/gl620a.c:112) usbnet_bh (drivers/net/usb/usbnet.c:572 drivers/net/usb/usbnet.c:1589) process_one_work (kernel/workqueue.c:3322) bh_worker (kernel/workqueue.c:3405) tasklet_action (kernel/softirq.c:965) handle_softirqs (kernel/softirq.c:622) run_ksoftirqd (kernel/softirq.c:1076) ... skb_pull() already verifies that the requested length fits the buffer and returns NULL otherwise. Move it ahead of the copy and check its result, so a packet that overruns the received data is rejected before it is read. Well-formed frames, whose packets are fully present, are unaffected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-27

Last Modified

2026-07-30

Generated

2026-08-17

AI Q&A

2026-07-28

EPSS Evaluated

2026-08-15

NVD

CVE-2026-64540

EUVD

EUVD-2026-49591

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in the Linux kernel's usbnet driver for the GL620A USB network adapter. The issue occurs in the genelink_rx_fixup() function, which processes incoming network packets. A malicious device can send a specially crafted packet that tricks the kernel into reading beyond the allocated memory buffer, causing an out-of-bounds read. This leaks kernel heap data into the network stack.

Detection Guidance

This vulnerability affects the Linux kernel's usbnet driver for GL620A devices. Detection requires checking kernel logs for KASAN slab-out-of-bounds errors related to genelink_rx_fixup. Use commands like 'dmesg | grep -i kasan' or 'journalctl -k | grep -i slab-out-of-bounds' to search for relevant errors.

Impact Analysis

An attacker could exploit this to read sensitive kernel memory, potentially exposing passwords, encryption keys, or other confidential data. The attack requires physical access to connect a malicious USB device but no special privileges. It could lead to information disclosure or system instability if exploited.

Compliance Impact

This vulnerability is an out-of-bounds read in the Linux kernel's USB network driver, allowing a malicious device to leak kernel heap memory. It does not directly impact data confidentiality or integrity for user data, but could potentially expose sensitive kernel memory that might contain residual data from other processes. This could indirectly affect compliance with GDPR or HIPAA if such exposed memory contained personal or health information.

Mitigation Strategies

Apply the Linux kernel patch that fixes the issue in the usbnet driver. If patching is not immediately possible, disable the affected GL620A USB network interface or unload the usbnet module until the patch is applied.

Hi! I’m here to help you understand CVE-2026-64540. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70