CVE-2026-64540

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup()

genelink_rx_fixup() splits an aggregated RX frame into its individual

packets, using a per-packet length taken from device-supplied data. That

length is only bounded by GL_MAX_PACKET_LEN (1514); it is never compared

against how many bytes were actually received.

A malicious GeneLink (GL620A) device can therefore send a short URB whose

header claims packet_count > 1 and a first packet of up to 1514 bytes.

skb_put_data(gl_skb, packet->packet_data, size);

then copies past the end of the receive buffer and hands the adjacent slab

contents up the network stack, an out-of-bounds read that leaks kernel heap.

No privilege is required: the path runs in the usbnet RX softirq as soon as

the interface is up.

BUG: KASAN: slab-out-of-bounds in genelink_rx_fixup (drivers/net/usb/gl620a.c:112)

Read of size 1514 at addr ffff888011309708 by task ksoftirqd/0/14

Ca

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References