CVE-2023-54110

usb: rndis_host: Secure rndis_query check against int overflow

State: Published
Severity: Not scored
Published: Dec 24, 2025
Updated: May 11, 2026
Reserved: Dec 24, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: rndis_host: Secure rndis_query check against int overflow

Variables off and len typed as uint32 in rndis_query function are controlled by incoming RNDIS response message thus their value may be manipulated. Setting off to a unexpectetly large value will cause the sum with len and 8 to overflow and pass the implemented validation step. Consequently the response pointer will be referring to a location past the expected buffer boundaries allowing information leakage e.g. via RNDIS_OID_802_3_PERMANENT_ADDRESS OID.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	ddda08624013e8435e9f7cfc34a35bd7b3520b6d to before 55782f6d63a5a3dd3b84c1e0627738fc5b146b4eAffected ddda08624013e8435e9f7cfc34a35bd7b3520b6d to before 02ffb4ecf0614c58e3d0e5bfbe99588c9ddc77c0Affected ddda08624013e8435e9f7cfc34a35bd7b3520b6d to before ebe6d2fcf7835f98cdbb1bd5e0414be20c321578Affected ddda08624013e8435e9f7cfc34a35bd7b3520b6d to before 232ef345e5d76e5542f430a29658a85dbef07f0bAffected ddda08624013e8435e9f7cfc34a35bd7b3520b6d to before 11cd4ec6359d90b13ffb8f85a9df8637f0cf8d95Affected ddda08624013e8435e9f7cfc34a35bd7b3520b6d to before 39eadaf5611ddd064ad1c53da65c02d2b0fe22a4Affected ddda08624013e8435e9f7cfc34a35bd7b3520b6d to before a713602807f32afc04add331410c77ef790ef77aAffected ddda08624013e8435e9f7cfc34a35bd7b3520b6d to before c7dd13805f8b8fc1ce3b6d40f6aff47e66b72ad2Affected
LinuxLinux	2.6.22Affected before 2.6.22Not affected 4.14.303 through 4.14.Not affected 4.19.270 through 4.19.Not affected 5.4.229 through 5.4.Not affected 5.10.163 through 5.10.Not affected 5.15.87 through 5.15.Not affected 6.0.19 through 6.0.Not affected 6.1.5 through 6.1.*Not affected 6.2 and laterNot affected

Product

Versions

LinuxLinux

ddda08624013e8435e9f7cfc34a35bd7b3520b6d to before 55782f6d63a5a3dd3b84c1e0627738fc5b146b4eAffected
ddda08624013e8435e9f7cfc34a35bd7b3520b6d to before 02ffb4ecf0614c58e3d0e5bfbe99588c9ddc77c0Affected
ddda08624013e8435e9f7cfc34a35bd7b3520b6d to before ebe6d2fcf7835f98cdbb1bd5e0414be20c321578Affected
ddda08624013e8435e9f7cfc34a35bd7b3520b6d to before 232ef345e5d76e5542f430a29658a85dbef07f0bAffected
ddda08624013e8435e9f7cfc34a35bd7b3520b6d to before 11cd4ec6359d90b13ffb8f85a9df8637f0cf8d95Affected
ddda08624013e8435e9f7cfc34a35bd7b3520b6d to before 39eadaf5611ddd064ad1c53da65c02d2b0fe22a4Affected
ddda08624013e8435e9f7cfc34a35bd7b3520b6d to before a713602807f32afc04add331410c77ef790ef77aAffected
ddda08624013e8435e9f7cfc34a35bd7b3520b6d to before c7dd13805f8b8fc1ce3b6d40f6aff47e66b72ad2Affected

LinuxLinux

2.6.22Affected
before 2.6.22Not affected
4.14.303 through 4.14.*Not affected
4.19.270 through 4.19.*Not affected
5.4.229 through 5.4.*Not affected
5.10.163 through 5.10.*Not affected
5.15.87 through 5.15.*Not affected
6.0.19 through 6.0.*Not affected
6.1.5 through 6.1.*Not affected
6.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.