0.0
NA
CVE-2026-64540
usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup()
Description

In the Linux kernel, the following vulnerability has been resolved: usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() genelink_rx_fixup() splits an aggregated RX frame into its individual packets, using a per-packet length taken from device-supplied data. That length is only bounded by GL_MAX_PACKET_LEN (1514); it is never compared against how many bytes were actually received. A malicious GeneLink (GL620A) device can therefore send a short URB whose header claims packet_count > 1 and a first packet of up to 1514 bytes. skb_put_data(gl_skb, packet->packet_data, size); then copies past the end of the receive buffer and hands the adjacent slab contents up the network stack, an out-of-bounds read that leaks kernel heap. No privilege is required: the path runs in the usbnet RX softirq as soon as the interface is up. BUG: KASAN: slab-out-of-bounds in genelink_rx_fixup (drivers/net/usb/gl620a.c:112) Read of size 1514 at addr ffff888011309708 by task ksoftirqd/0/14 Call Trace: ... __asan_memcpy (mm/kasan/shadow.c:105) genelink_rx_fixup (include/linux/skbuff.h:2814 drivers/net/usb/gl620a.c:112) usbnet_bh (drivers/net/usb/usbnet.c:572 drivers/net/usb/usbnet.c:1589) process_one_work (kernel/workqueue.c:3322) bh_worker (kernel/workqueue.c:3405) tasklet_action (kernel/softirq.c:965) handle_softirqs (kernel/softirq.c:622) run_ksoftirqd (kernel/softirq.c:1076) ... skb_pull() already verifies that the requested length fits the buffer and returns NULL otherwise. Move it ahead of the copy and check its result, so a packet that overruns the received data is rejected before it is read. Well-formed frames, whose packets are fully present, are unaffected.

INFO

Published Date :

July 27, 2026, 9:17 p.m.

Last Modified :

July 27, 2026, 9:17 p.m.

Remotely Exploit :

No

Source :

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products

The following products are affected by CVE-2026-64540 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

No affected product recoded yet

Solution
Fix out-of-bounds read by validating packet lengths before copying data.
  • Update the Linux kernel to include the fix.
  • Validate packet lengths before copying.
  • Reject oversized packets before reading.
  • Ensure skb_pull() checks buffer limits.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-64540 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-64540 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-64540 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2026-64540 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Jul. 27, 2026

    Action Type Old Value New Value
    Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '47ee3051c856cc2aa95d35d577a8cb37279d540f', 'lessThan': '255d03551f94c7bdd86c7d9181a70b21917d829f', 'versionType': 'git'}, {'status': 'affected', 'version': '47ee3051c856cc2aa95d35d577a8cb37279d540f', 'lessThan': '4359376e6238d89977a35086e47ca3b07f43e850', 'versionType': 'git'}, {'status': 'affected', 'version': '47ee3051c856cc2aa95d35d577a8cb37279d540f', 'lessThan': '8624e179fa3ce23c2fbd1a198ce30764b73f054a', 'versionType': 'git'}, {'status': 'affected', 'version': '47ee3051c856cc2aa95d35d577a8cb37279d540f', 'lessThan': '573418f7ea8f859a841417eb4b915594094fd967', 'versionType': 'git'}, {'status': 'affected', 'version': '47ee3051c856cc2aa95d35d577a8cb37279d540f', 'lessThan': '0575599e451aff3c5329922562374a2cab25fc51', 'versionType': 'git'}, {'status': 'affected', 'version': '47ee3051c856cc2aa95d35d577a8cb37279d540f', 'lessThan': '0a7d9c7c5f1f208c523abbb4db6aea7bc1fad3db', 'versionType': 'git'}, {'status': 'affected', 'version': '47ee3051c856cc2aa95d35d577a8cb37279d540f', 'lessThan': '3ef79fa3860e644c8de7834fa7300e1c58f38862', 'versionType': 'git'}, {'status': 'affected', 'version': '47ee3051c856cc2aa95d35d577a8cb37279d540f', 'lessThan': '8ff7f2a6da4fccaa5cc9be7251a24e71e29fbd1a', 'versionType': 'git'}], 'programFiles': ['drivers/net/usb/gl620a.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '2.6.14'}, {'status': 'unaffected', 'version': '0', 'lessThan': '2.6.14', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/net/usb/gl620a.c'], 'defaultStatus': 'affected'}]
    Added Description In the Linux kernel, the following vulnerability has been resolved: usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() genelink_rx_fixup() splits an aggregated RX frame into its individual packets, using a per-packet length taken from device-supplied data. That length is only bounded by GL_MAX_PACKET_LEN (1514); it is never compared against how many bytes were actually received. A malicious GeneLink (GL620A) device can therefore send a short URB whose header claims packet_count > 1 and a first packet of up to 1514 bytes. skb_put_data(gl_skb, packet->packet_data, size); then copies past the end of the receive buffer and hands the adjacent slab contents up the network stack, an out-of-bounds read that leaks kernel heap. No privilege is required: the path runs in the usbnet RX softirq as soon as the interface is up. BUG: KASAN: slab-out-of-bounds in genelink_rx_fixup (drivers/net/usb/gl620a.c:112) Read of size 1514 at addr ffff888011309708 by task ksoftirqd/0/14 Call Trace: ... __asan_memcpy (mm/kasan/shadow.c:105) genelink_rx_fixup (include/linux/skbuff.h:2814 drivers/net/usb/gl620a.c:112) usbnet_bh (drivers/net/usb/usbnet.c:572 drivers/net/usb/usbnet.c:1589) process_one_work (kernel/workqueue.c:3322) bh_worker (kernel/workqueue.c:3405) tasklet_action (kernel/softirq.c:965) handle_softirqs (kernel/softirq.c:622) run_ksoftirqd (kernel/softirq.c:1076) ... skb_pull() already verifies that the requested length fits the buffer and returns NULL otherwise. Move it ahead of the copy and check its result, so a packet that overruns the received data is rejected before it is read. Well-formed frames, whose packets are fully present, are unaffected.
    Added Reference https://git.kernel.org/stable/c/0575599e451aff3c5329922562374a2cab25fc51
    Added Reference https://git.kernel.org/stable/c/0a7d9c7c5f1f208c523abbb4db6aea7bc1fad3db
    Added Reference https://git.kernel.org/stable/c/255d03551f94c7bdd86c7d9181a70b21917d829f
    Added Reference https://git.kernel.org/stable/c/3ef79fa3860e644c8de7834fa7300e1c58f38862
    Added Reference https://git.kernel.org/stable/c/4359376e6238d89977a35086e47ca3b07f43e850
    Added Reference https://git.kernel.org/stable/c/573418f7ea8f859a841417eb4b915594094fd967
    Added Reference https://git.kernel.org/stable/c/8624e179fa3ce23c2fbd1a198ce30764b73f054a
    Added Reference https://git.kernel.org/stable/c/8ff7f2a6da4fccaa5cc9be7251a24e71e29fbd1a
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.