CVE-2026-64540

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup()<br /> <br /> genelink_rx_fixup() splits an aggregated RX frame into its individual<br /> packets, using a per-packet length taken from device-supplied data. That<br /> length is only bounded by GL_MAX_PACKET_LEN (1514); it is never compared<br /> against how many bytes were actually received.<br /> <br /> A malicious GeneLink (GL620A) device can therefore send a short URB whose<br /> header claims packet_count &gt; 1 and a first packet of up to 1514 bytes.<br /> <br /> skb_put_data(gl_skb, packet-&gt;packet_data, size);<br /> <br /> then copies past the end of the receive buffer and hands the adjacent slab<br /> contents up the network stack, an out-of-bounds read that leaks kernel heap.<br /> No privilege is required: the path runs in the usbnet RX softirq as soon as<br /> the interface is up.<br /> <br /> BUG: KASAN: slab-out-of-bounds in genelink_rx_fixup (drivers/net/usb/gl620a.c:112)<br /> Read of size 1514 at addr ffff888011309708 by task ksoftirqd/0/14<br /> Call Trace:<br /> ...<br /> __asan_memcpy (mm/kasan/shadow.c:105)<br /> genelink_rx_fixup (include/linux/skbuff.h:2814 drivers/net/usb/gl620a.c:112)<br /> usbnet_bh (drivers/net/usb/usbnet.c:572 drivers/net/usb/usbnet.c:1589)<br /> process_one_work (kernel/workqueue.c:3322)<br /> bh_worker (kernel/workqueue.c:3405)<br /> tasklet_action (kernel/softirq.c:965)<br /> handle_softirqs (kernel/softirq.c:622)<br /> run_ksoftirqd (kernel/softirq.c:1076)<br /> ...<br /> <br /> skb_pull() already verifies that the requested length fits the buffer and<br /> returns NULL otherwise. Move it ahead of the copy and check its result, so<br /> a packet that overruns the received data is rejected before it is read.<br /> Well-formed frames, whose packets are fully present, are unaffected.