Description
Buffer overflow in the USB Gadget RNDIS implementation in the Linux kernel before 2.6.16 allows remote attackers to cause a denial of service (kmalloc'd memory corruption) via a remote NDIS response to OID_GEN_SUPPORTED_LIST, which causes memory to be allocated for the reply data but not the reply structure.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | kernel-source-2.4.27 | 2.4.27-10sarge3 | DSA-1097-1 |
| Debian 3.1 | kernel-source-2.6.8 | 2.6.8-16sarge3 | DSA-1103 |
Advisories 2
- DSA-1097-1 kernel-source-2.4.27 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1103 kernel-source-2.6.8 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- 17831 vdb-entry
- ADV-2006-2554 vdb-entry
- USN-281-1 vendor-advisory
- ADV-2006-1046 vdb-entry
- MDKSA-2006:123 vendor-advisory
- DSA-1097 vendor-advisory
- 19955 third-party-advisory
- http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16
- DSA-1103 vendor-advisory
- 21045 third-party-advisory
- 19330 third-party-advisory
- 20671 third-party-advisory
- 20914 third-party-advisory
- http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8763716bfe4d8a16bef28c9947cf9d799b1796a5