In rndis_query_oid in drivers/net/wireless/rndis_wlan.c in the Linux kernel through 6.1.5, there is an integer overflow in an addition.
No PoCs from references.
- https://github.com/ARPSyndicate/cvemon
- https://github.com/szymonh/szymonh