---
id: CVE-2026-64540
title: >-
  kernel: usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup()
  (CVE-2026-64540)
summary: >-
  A flaw was found in the Linux kernel's GeneLink (GL620A) USB network driver. A
  malicious GeneLink device can send specially crafted Universal Serial Bus
  (USB) packets that cause an out-of-bounds read vulnerability. This can lead to
  the dis…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe: CWE-125
vendor: Red Hat
product: Red Hat Enterprise Linux 9
affected:
  - enterprise_linux 10
  - enterprise_linux 6
  - enterprise_linux 7
  - enterprise_linux 8
  - enterprise_linux 9
published: '2026-07-27'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T11:18:35+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64540.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64540.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-64540'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2507802'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-64540'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-64540'
  - url: >-
      https://lore.kernel.org/linux-cve-announce/2026072735-CVE-2026-64540-d315@gregkh/T
  - url: 'https://git.kernel.org/stable/c/255d03551f94c7bdd86c7d9181a70b21917d829f'
  - url: 'https://git.kernel.org/stable/c/4359376e6238d89977a35086e47ca3b07f43e850'
  - url: 'https://git.kernel.org/stable/c/8624e179fa3ce23c2fbd1a198ce30764b73f054a'
  - url: 'https://git.kernel.org/stable/c/573418f7ea8f859a841417eb4b915594094fd967'
  - url: 'https://git.kernel.org/stable/c/0575599e451aff3c5329922562374a2cab25fc51'
  - url: 'https://git.kernel.org/stable/c/0a7d9c7c5f1f208c523abbb4db6aea7bc1fad3db'
  - url: 'https://git.kernel.org/stable/c/3ef79fa3860e644c8de7834fa7300e1c58f38862'
  - url: 'https://git.kernel.org/stable/c/8ff7f2a6da4fccaa5cc9be7251a24e71e29fbd1a'
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
  - score-dispute
epss: 0.00275
epssPercentile: 0.19773
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-16T15:42:07.103763Z'
scores:
  vendor: 5.5
  cna: 8.1
ingestedAt: '2026-10-16T17:24:46.830Z'
---

## Overview

A flaw was found in the Linux kernel's GeneLink (GL620A) USB network driver. A malicious GeneLink device can send specially crafted Universal Serial Bus (USB) packets that cause an out-of-bounds read vulnerability. This can lead to the disclosure of sensitive kernel memory, potentially revealing confidential system information. No special privileges are required for an attacker to exploit this vulnerability.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, … · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64540.json)

**kernel: usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup()** — rated Moderate by Red Hat. Released 2026-07-27, updated 2026-10-23.

Affected:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9

No fix planned:

- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9

## Remediation

Out of support scope