CVE-2023-54110: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54110 is an integer overflow vulnerability in the Linux kernel's rndis_host USB driver that can lead to information leakage. Specifically, the rndis_query function uses uint32 variables (off and len) sourced from incoming RNDIS response messages, which an attacker can manipulate. Setting off to an unexpectedly large value causes the sum with len and 8 to overflow, bypassing the implemented bounds check and allowing the response pointer to reference memory outside the intended buffer — potentially exposing sensitive data such as the device's permanent MAC address via RNDIS_OID_802_3_PERMANENT_ADDRESS. The vulnerability was introduced as far back as Linux kernel 2.6.22 and was publicly disclosed on December 24, 2025. Patched versions include 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.87, 6.0.19, 6.1.5, and 6.2+ (Feedly/EUVD). No CVSS score has been officially assigned (base score listed as 0.0) (Feedly).

The root cause is an integer overflow (CWE-190) in the rndis_query function within drivers/net/usb/rndis_host.c. The variables off and len, both typed as uint32_t, are derived directly from a remote RNDIS response message and are not adequately validated before being summed with the constant 8. A malicious or compromised USB device (or a device emulated by an attacker) can supply a crafted RNDIS response with an oversized off value, causing the arithmetic sum to wrap around and pass the bounds check. The resulting out-of-bounds pointer dereference allows the kernel to read memory beyond the intended response buffer, constituting an information disclosure. The fix involves adding proper overflow-safe validation of off and len before pointer arithmetic (Feedly/EUVD, Kernel Patches).

The primary impact is information leakage from kernel memory. By exploiting the out-of-bounds read, an attacker controlling a malicious USB RNDIS device can cause the kernel to expose data beyond the intended response buffer — for example, reading the host system's permanent MAC address or potentially other adjacent kernel memory contents. Confidentiality is the main concern; there is no direct evidence of code execution or availability impact from this vulnerability alone. The scope is limited to systems that connect to attacker-controlled or compromised USB RNDIS devices (Feedly).

The Linux kernel project has released patches across all affected stable branches. Users should update to the following patched versions or later: 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.87, 6.0.19, 6.1.5, or 6.2 (Feedly/EUVD). As a workaround where patching is not immediately possible, restricting the use of untrusted USB RNDIS devices (e.g., via USB device authorization policies or disabling the rndis_host kernel module with modprobe -r rndis_host) can reduce exposure. Distribution-specific updates (e.g., SUSE, Red Hat) should be applied as they become available (LinuxSecurity).