Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-68088— usb: gadget: function: rndis: add length check to response query

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel 5.10.261之前版本、5.15.212之前版本、6.1.178之前版本、6.6.145之前版本、6.12.96之前版本、6.18.39之前版本和7.1.4之前版本存在安全漏洞，该漏洞源于rndis_query_response()函数对BufLength和BufOffset缺少长度检查。

AI Predicted 7.5 Difficulty: Moderate EPSS 0.18% · P7

Possible ATT&CK Techniques 1 AI

T1203 · Exploitation for Client Execution

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 340600ab4cf0cc41efd01a65af97ebb7d35a7f85< efcf4e4eeea0d69d8da72a7bc5cbd49b6192260e affected
340600ab4cf0cc41efd01a65af97ebb7d35a7f85< bb2b4402b4571b0c989b977779f7be01107ca425 affected
340600ab4cf0cc41efd01a65af97ebb7d35a7f85< 585921866d2d7d65d4b0d89927c78f784668cf5f affected
340600ab4cf0cc41efd01a65af97ebb7d35a7f85< caea8b120604312bab2bfeb1a972f9cd17019e93 affected
340600ab4cf0cc41efd01a65af97ebb7d35a7f85< f5870777458d8be65d7cd08bc750a03f17998350 affected
340600ab4cf0cc41efd01a65af97ebb7d35a7f85< e01e7814b4223560eab0513b7c15b8c82bdc83f3 affected
340600ab4cf0cc41efd01a65af97ebb7d35a7f85< b09716040f3fa4a252eeda3ceb5295ea0e39c1fb affected
340600ab4cf0cc41efd01a65af97ebb7d35a7f85< 95f90eea070837f7c72207d5520f805bdefc3bc5 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-68088

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
usb: gadget: function: rndis: add length check to response query
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check to response query Add variable representations for BufLength and BufOffset in rndis_query_response(), and perform a length check on them. This is identical to how rndis_set_response() handles these parameters.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel 5.10.261之前版本、5.15.212之前版本、6.1.178之前版本、6.6.145之前版本、6.12.96之前版本、6.18.39之前版本和7.1.4之前版本存在安全漏洞，该漏洞源于rndis_query_response()函数对BufLength和BufOffset缺少长度检查。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 340600ab4cf0cc41efd01a65af97ebb7d35a7f85 ~ efcf4e4eeea0d69d8da72a7bc5cbd49b6192260e -
Linux Linux 2.6.13 -

II. Public POCs for CVE-2026-68088

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-68088

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-68088 (7)

Other References for CVE-2026-68088 (1)

Same Patch Batch · Linux · 2026-08-10 · 344 CVEs total

CVE-2026-68159 9.8 CRITICAL libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE
CVE-2026-68381 9.8 CRITICAL ksmbd: pin conn during async oplock break notification
CVE-2026-68385 9.8 CRITICAL s390/checksum: Fix csum_partial() without vector facility
CVE-2026-68388 9.8 CRITICAL smb/client: handle overlapping allocated ranges in fallocate
CVE-2026-68117 9.8 CRITICAL tipc: clear sock->sk on the failed-insert path in tipc_sk_create()
CVE-2026-68170 9.8 CRITICAL mptcp: fix stale skb->sk reference on subflow close
CVE-2026-68123 9.8 CRITICAL openvswitch: fix GSO userspace truncation underflow
CVE-2026-68161 9.8 CRITICAL sctp: close UDP tunnel sockets during netns teardown
CVE-2026-68127 9.8 CRITICAL ila: reload IPv6 header after pskb_may_pull in checksum adjust
CVE-2026-68160 9.8 CRITICAL ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()
CVE-2026-68144 9.8 CRITICAL phonet: pep: fix use-after-free in pep_get_sb()
CVE-2026-68137 9.8 CRITICAL net/x25: fix use-after-free in x25_kill_by_neigh()
CVE-2026-68302 9.8 CRITICAL amt: re-read skb header pointers after every pull
CVE-2026-68300 9.8 CRITICAL sctp: auth: verify auth requirement when auth_chunk is NULL
CVE-2026-68426 9.8 CRITICAL xfrm: fix stale skb->prev after async crypto steals a GSO segment
CVE-2026-68136 9.8 CRITICAL net: gro: fix double aggregation of flush-marked skbs
CVE-2026-68154 9.8 CRITICAL libceph: reject zero bucket types in crush_decode
CVE-2026-68158 9.8 CRITICAL libceph: Fix multiplication overflow in decode_new_up_state_weight()
CVE-2026-68156 9.8 CRITICAL libceph: refresh auth->authorizer_buf{,_len} after authorizer update
CVE-2026-68124 9.6 CRITICAL mctp: serial: handle zero-length frames to prevent rx buffer overflow

Showing top 20 of 344 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-68088

No comments yet

Leave a comment